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ABSTRACT 


Recently,  the  use  of  Probabilistic  Risk  Assessment  (PRA)  techniques  to  perform  laser  safety  and 
hazard  analysis  for  high  output  lasers  in  outdoor  environments  has  become  an  increasingly 
accepted  alternative  to  standard  risk  analysis  methods,  based  on  Maximum  Permissible  Exposure 
(MPE)  limits.  Over  the  past  ten  years,  the  United  Kingdom  (UK)  Ministry  of  Defence  (MoD) 
and  the  United  States  (US)  Air  Force  Research  Laboratory  (AFRL)  have  collaborated  to  develop 
a  jointly-owned,  PRA-based,  laser  Range  safety  tool,  the  Military  Advanced  Technology 
Integrated  Laser  hazarD  Assessment  (MATILDA)  system.  The  UK  MoD  has  been  developing 
PRA-based  laser  hazard  analysis  models  for  nearly  four  decades,  and  using  them  to  assess  laser 
irradiation  risks  to  unprotected  persons  from  laser  test  and  training  operations  on  UK  military 
Ranges.  The  Air  Force  Research  Laboratory  wishes  to  develop  PRA-based  hazard  analysis 
models  for  outdoor  high  energy  laser  applications,  and  began  the  collaboration  to  leverage  the 
PRA  modelling  expertise  of  the  UK.  Initial  MATILDA  code  development  was  based  on  the 
PRA  “partition”  model  developed  to  perform  Range  safety  clearances  for  the  UK  Thermal 
Imaging  Airborne  Laser  Designator  (TIALD)  system.  MATILDA  is  the  first  military  software 
tool  to  contain  a  complete  end-to-end  laser  PRA  model,  crafted  for  Range  applications,  and  with 
generalized  terrain  modelling.  In  the  future  it  will  provide  a  starting  point  for  development  of 
more  advanced  laser  PRA  models  and  tools. 


1  INTRODUCTION 

Recently,  the  use  of  Probabilistic  Risk  Assessment  (PRA)  techniques  [1,2]  to  perform  laser 
safety  and  hazard  analysis  for  high  output  lasers  in  outdoor  environments  [3-6]  has  become  an 
increasingly  accepted  alternative  to  standard  risk  analysis  methods  [7],  based  on  Maximum 
Permissible  Exposure  (MPE)  limits  [8,9].  Over  the  past  ten  years,  the  United  Kingdom  (UK) 
Ministry  of  Defence  (MoD)  and  the  United  States  (US)  Air  Force  Research  Laboratory  (AFRL) 
have  collaborated  to  develop  a  jointly-owned,  PRA-based,  laser  Range  safety  tool,  the  Military 
Advanced  Technology  Integrated  Laser  hazarD  Assessment  (MATILDA)  system  [10-14].  This 
collaboration  has  been  covered,  sequentially,  by  two  US-UK  Project  Arrangements  (PAs):  No. 
DOD-MOD-AF-06-0004  (2007-2012)  and  No.  DOD-MOD-AF- 12-0004  (2012-2017). 

The  move  towards  PRA,  by  some  laser  safety  experts  and  organizations,  has  been  driven  by  the 
limitations  of  standard,  or  MPE-based,  risk  analysis.  In  a  standard  risk  analysis,  exposures  are 
simply  characterized  as  safe  or  unsafe  based  on  comparison  to  the  MPE;  no  quantitative  estimate 
of  risk  is  provided.  Standard  risk  analysis  also  implicitly  assumes  that  risk  can  be  completely 
mitigated  [6],  giving  a  “sure-safe,”  or  zero  risk,  condition  as  a  final  result.  In  controlled  indoor 
environments,  such  as  factories  or  labs,  this  may  be  true,  or  nearly  true.  In  uncontrolled  outdoor 
environments,  such  as  military  test  Ranges  or  combat  operations,  a  true  zero  risk  condition  is 
unachievable.  Thus,  a  method  giving  a  quantitative  estimate  of  risk  (PRA)  is  preferable. 

PRA-based  laser  hazard  analysis  offers  a  number  of  advantages  over  standard  risk  analysis 
methods.  First,  it  provides  a  quantified  assessment  of  human  risk  (probability  of  injury)  as  a 
function  of  location.  Second,  it  captures  the  probabilities  and  consequences  of  human  error  and 
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laser  fault/failure  conditions,  factors  which  are  critical  to  valid  hazard  assessments  for  military 
laser  operations  in  uncontrolled  outdoor  environments.  Third,  and  most  importantly,  PRA 
analysis  does  not  assume,  or  require,  a  zero  risk  condition  as  a  final  result.  Instead,  it  compares 
the  quantified  risk  against  a  maximum  acceptable  (non-zero)  risk  value.  This  produces  less 
restrictive  Range  clearances,  while  still  maintaining  acceptable  safety  levels  for  Range  personnel 
and  members  of  the  public.  This  last  advantage  is  critical  for  the  UK,  where  the  small  size  of  UK 
Ranges  and  the  possibility  that  laser  beams  might  escape  Range  boundaries  make  a  zero  risk 
condition  for  Range  testing  unacceptably  restrictive. 

The  UK  MoD  has  been  developing  PRA-based  laser  hazard  analysis  models  for  nearly  four 
decades,  and  using  them  to  assess  laser  irradiation  risks  to  unprotected  persons  from  laser  test 
and  training  operations  on  UK  military  Ranges.  Over  that  time,  PRA-based  Range  clearance 
techniques  have  ensured  the  safe  operation  of  airborne  and  ground-based  military  laser 
rangefinders  and  target  designators  during  development  trials  and  operational  training  exercises. 
Prior  to  the  US-UK  collaboration,  however,  the  MoD  had  not  allocated  the  resources  to  create  an 
expert  software  tool  like  MATILDA,  which  performs  a  complete  end-to-end  PRA  hazard 
analysis  for  airborne  laser  Range  applications,  with  generalized  terrain  modelling. 

Beginning  in  1998,  with  AFRL  safety  support  to  the  Airborne  Laser  (ABL)  and  Advanced 
Tactical  Laser  (ATL)  programs,  the  United  States  Air  Force  (USAF)  had  the  goal  of  developing 
PRA-based  hazard  analysis  models  for  outdoor  high  energy  laser  (HEL)  applications.  Very  long 
HEL  hazard  distances,  combined  with  the  uncertainties  inherent  in  outdoor  operations,  make 
zero  risk  unachievable  in  HEL  Range  tests.  Thus,  in  assessing  the  potential  risks  posed  by  HEL 
operations,  a  shift  to  probabilistic  analysis  is  preferable.  The  US  began  the  collaboration 
described  in  this  paper  in  order  to  leverage  the  PRA  modelling  expertise  of  the  UK,  with  an  eye 
to  future  development  of  an  HEL  PRA  tool.  Development  of  US  HEL  PRA  tools  is  in  fact 
underway  at  this  time,  but  it  has  not  been  completed  and  will  not  be  documented  here.  The 
purpose  of  this  report  is  to  document  the  development  and  capabilities  of  Version- 1.6.2  of  the 
MATILDA  tool,  which  is  currently  valid  only  for  direct  beam  hazards,  created  by  low-to- 
moderate  power  airborne  laser  designators,  operating  at  1064  run,  and  firing  at  stationary  targets 
on  military  ranges. 

In  the  development  of  MATILDA,  UK  PRA  modelling  experience  was  combined  with  AFRL 
expertise  in  development  of  complex  software  tools  for  laser  hazard  analysis  and  laser  Range 
safety.  Initial  MATILDA  code  development  (2007-2012)  was  based  on  the  PRA  “partition” 
model  developed  to  perform  Range  safety  clearances  for  the  UK  Thermal  Imaging  Airborne 
Laser  Designator  (TIALD)  system.  The  TIALD  model  “fault-free”  laser  hazard  analysis  is 
geometrically  similar  to  the  standard  risk  analysis  methods  currently  used  for  laser  safety 
clearances  on  US  Ranges  [7].  However,  the  TIALD  model  contains  an  additional  probabilistic 
hazard  analysis  component,  which  assesses  probability  of  injury  to  an  unprotected  person  in  the 
event  of  a  fault  or  failure  in  the  laser  directional  control  system.  The  “UK  Laser  PRA  Model,” 
described  in  Section  2,  refers  to  the  TIALD  model,  as  implemented  in  MATILDA. 

The  MATILDA  system  is  a  new  software  tool  based  on  open-source  Geographic  Information 
System  (GIS)  technology  that  integrates  relevant  laser  system  performance  parameters  with 
environmental  data  appropriate  to  the  Range  location  where  the  system  is  being  operated.  The 
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first  five-year  US-UK  collaboration  (2007-2012)  was  successfully  completed  by  the  release  of 
Version-1.6.2  of  MATILDA,  which  is  documented  in  this  report.  The  second  five-year 
collaboration  (2012-2017)  is  currently  underway,  with  the  goal  of  producing  an  updated  version 
of  MATILDA,  with  enhanced  capabilities.  MATILDA  is  the  first  military  software  tool  to 
contain  a  complete  end-to-end  laser  PRA  model,  crafted  for  Range  applications,  and  with 
generalized  terrain  modelling.  In  the  future  it  will  provide  a  starting  point  for  development  of 
more  advanced  laser  PRA  models  and  tools. 

2  UK  LASER  PRA  MODEL 

2.1  UK  Need  for  a  PRA-Based  Approach 

The  primary  hazard  associated  with  the  use  of  low-to-moderate  power  lasers  on  military  Ranges 
is  potential  injury  to  exposed  tissue,  in  particular  the  eye.  While  protective  measures  can  be 
applied  for  persons  within  the  Controlled  Range  Area  (CRA),  the  main  concern  -  particularly  in 
the  case  of  airborne  laser  target  designators  and  rangefinders  -  is  avoidance  of  possible  ocular 
injury  to  unprotected  members  of  the  general  public,  should  laser  energy  escape  the  confines  of 
the  Range.  Traditionally,  the  ocular  hazards  associated  with  a  laser’s  output  have  been  assessed 
in  terms  of  the  Maximum  Permissible  Exposure,  from  which  a  corresponding  Nominal  Ocular 
Hazard  Distance  (NOHD)  is  determined  [8,9].  The  NOHD  represents  a  safe  viewing  distance  at 
which  an  observer  can  be  exposed  to  the  laser  energy  over  a  given  period  of  time  without  risk  of 
injury  to  the  eye.  Typical  exposure  periods  for  military  laser  systems  can  vary  from  the  order  of 
nanoseconds  (the  duration  of  a  single  Q-switched  laser  pulse)  to  as  long  as  10  seconds  (for  a 
stream  of  laser  pulses). 

Many  military  laser  systems  operate  at  wavelengths  within  the  near  infrared.  Of  these,  1064  nm 
radiation  is  particularly  hazardous  to  unprotected  eyesight,  due  to  the  transparency  of  the 
atmosphere  and  the  aqueous  media  at  that  wavelength.  Laser  energy  of  sufficient  intensity  at 
1064  nm  can  cause  permanent  scarring  of  the  retina,  with  significant  loss  of  visual  acuity.  The 
NOHD  for  a  typical  airborne  laser  designator  emitting  at  1064  nm  is  on  the  order  of  tens  of 
kilometers,  a  hazard  distance  that  might  be  substantially  increased  once  correction  factors  for 
magnifying  optics  and  atmospheric  propagation  are  taken  into  account.  We  should  note  that  the 
general  practice  in  UK  NOHD  calculations  is  to  include  a  correction  factor  for  atmospheric 
scintillation,  but  not  attenuation.  In  contrast,  US  NOHD  calculations  generally  include 
correction  factors  for  atmospheric  attenuation,  but  not  scintillation. 

An  additional  consideration  in  the  hazard  assessment  is  the  angular  spread  over  which  laser 
energy  may  be  fired.  For  airborne  target  designators  and  rangefinders  especially,  the  wide  field 
of  regard  of  the  laser  steering  mechanism,  relative  to  the  aircraft  velocity  vector,  can  produce  a 
risk  of  laser  energy  being  misdirected  outside  the  CRA.  A  nominal  hazard  zone  can  be  defined 
by  sweeping  the  applicable  NOHD  over  the  angular  range  of  possible  directions  in  which  the 
laser  could  be  fired.  It  is  necessary  to  implement  adequate  risk  management  procedures  to 
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ensure  that  airborne  military  lasers  with  significantly  large  hazard  zones  can  be  operated  safely 
within  the  context  of  an  outdoor  training  or  test  Range.  For  a  hazard  assessment  based  on  the 
MPE,  such  a  requirement  can  be  satisfied  by  ensuring  either  (a)  that  laser  energy  does  not  escape 
the  CRA  under  any  circumstances  or  (b)  that  the  laser  is  never  fired  when  an  uncontrolled  area 
outside  the  Range,  where  unprotected  persons  might  be  present,  is  within  the  appropriate  NOHD. 

Where  sufficient  real  estate  is  available,  it  is  possible  to  ensure  confinement  of  the  hazard  zone 
within  the  CRA  without  imposing  onerous  restrictions  on  the  permitted  laser  firing  envelope.  In 
such  cases,  the  laser  energy  is  said  to  have  been  “back-stopped”  within  the  Range.  US  Ranges 
are  typically  large  enough  that  back-stopping  the  beam  is  feasible,  with  the  correct  attack  track 
and  firing  angle.  Training  Ranges  within  the  UK,  however,  are  generally  small  in  extent  -  of  the 
order  of  a  few  kilometers  across  -  and  the  confined  geography  of  the  UK  means  that  training 
Ranges  are  never  very  far  from  populated  areas.  Should  hazardous  levels  of  laser  energy  escape 
the  confines  of  a  Range  in  the  UK  for  any  reason,  it  is  possible  that  an  unprotected  person  could 
be  exposed  to  laser  irradiation  in  excess  of  the  MPE.  In  such  cases  the  zero  risk  criterion, 
implicit  in  standard  risk  analysis,  creates  a  significant  problem  from  the  perspective  of  practical 
laser  testing  and  training  opportunities. 

While  the  NOHD  represents  an  appropriate  safe  exposure  distance,  the  MPE-criterion  provides 
no  quantitative  information  on  the  probable  risk  of  injury  for  unprotected  observers  inside  the 
NOHD  (i.e.,  in  the  hazard  zone).  Additionally,  a  strict  implementation  of  the  MPE  safety 
standard  across  the  entire  laser  field  of  regard  does  not  take  into  account  the  possible  variation  in 
the  risk  of  laser  energy  being  fired  in  any  given  direction.  With  a  well  designed  and  properly 
calibrated  laser  directional  control  system,  it  would  be  expected  that  most  -  if  not  all  -  of  the 
laser  energy  will  be  reliably  incident  on  or  close  to  the  target.  In  most  cases  then,  the  risk  of 
laser  energy  escaping  the  CRA  will  be  small. 

With  the  relatively  small  size  of  UK  Ranges,  the  stringent  limitations  on  the  laser  firing 
envelope,  required  to  satisfy  the  MPE-criterion,  could  totally  preclude  practical  testing  of,  or 
training  with,  airborne  laser  systems,  even  though  the  actual  risk  of  injury  may  be  negligible. 
This  implies  that  standard  MPE-based  risk  analysis  is  generally  too  inflexible  for  UK  Range 
clearance  requirements.  Instead,  UK  Range  clearance  models  are  probabilistic,  and  based  on  the 
principle  of  residual  risk  being  “As  Low  As  Reasonably  Practicable”  (ALARP)  [15].  The  use  of 
the  ALARP  principle  in  UK  hazard  assessment  arises  from  the  provisions  of  the  UK  Health  and 
Safety  at  Work  Act  of  1974  [16].  Such  requirements  can  only  be  satisfied  by  the  use  of  a  risk- 
based  approach  to  laser  hazard  assessment.  The  outcome  of  such  a  risk-based  assessment 
technique  is  a  risk  management  process  (see  Fig.l),  by  which  adverse  events,  and  the  inherent 
uncertainties  with  which  they  occur,  can  be  rigorously  identified  and  mitigated. 
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Figure  1  provides  a  sehematic  illustration  of  the  UK  risk  assessment  proeess,  which  comprises 
two  distinct  stages.  The  risk  analysis  stage  constitutes  a  hazard  assessment  of  the  laser  system 
performance  when  operating  either  as  intended,  or  in  the  event  of  a  laser  sightline  directional 
control  system  fault  or  failure.  The  laser  system  hazard  assessment  in  the  UK  is  expressed 
formally  in  a  Laser  Safety  Paper  (LSP),  the  production  of  which  is  the  responsibility  of  the  laser 
system  project  authority.  The  Probabilistic  Range  Clearance  Model  (PRCM)  provides  a  means 
by  which  hazards  arising  from  the  laser  system  operation  can  be  evaluated,  and  is  necessarily 
based  on  the  performance  assessment  described  in  the  LSP.  The  PRCM  represents  the 
mathematical  implementation  of  the  “Pe-Pi-Pod”  chain  of  adverse  risk  events  model.  An 
illustration  of  the  “Pe-Pi-Pod”  risk  chain  model,  in  a  general  risk  modelling  context,  is  provided 
in  Figure  2  and  further  discussion  of  the  risk  chain  model  is  provided  in  Section  2.2. 


Figure  1:  Laser  Safety  Risk  Management  Process 
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The  hazard  assessment  for  the  laser  system  operation  is  the  subjeet  of  the  risk  management  and 
control  stage.  Laser  firing  restrictions  for  a  given  Range,  target  and  attack  profile  combination 
are  generated  by  application  of  the  PRCM,  as  encoded  in  the  MATILDA  tool.  The  resulting 
restrictions  on  the  permitted  laser  firing  envelope  may  then  be  evaluated  in  context  of  other  (non¬ 
laser)  safety  information,  from  which  actual  laser  firing  restrictions  can  be  derived  and 
promulgated  to  the  system  operators  via  Range  orders.  There  are  hence  two  separate  hazard 
assessments  encapsulated  in  Figure  1:  the  laser  system  hazard  assessment  as  encapsulated  in  the 
LSP  followed  by  the  operational  laser  hazard  assessment  as  effected  by  the  PRCM  application. 
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Figure  2:  The  “PE-PI-POD”  Catastrophic  Chain  of  Events  Model 
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2.2  A  Risk-Based  Approach  to  Laser  Hazard  Assessment 

The  risk  of  an  adverse  event,  such  as  a  laser-induced  ocular  injury  in  an  unprotected  population, 
can  be  expressed  in  terms  of  a  “risk  chain”  comprising  three  main  components  [17]:  (i)  a  risk 
source,  (ii)  an  exposure  process  and  (iii)  a  causal  process  (see  Fig.  2).  In  the  case  of  airborne 
laser  operations,  the  risk  source  is  the  laser.  The  exposure  process  is  the  means  by  which  laser 
energy  from  an  airborne  platform  could  be  misdirected  outside  the  CRA,  causing  an  unprotected 
observer  to  be  irradiated.  The  causal  process  is  the  mechanism  by  which  that  misdirected  laser 
energy  could  cause  an  ocular  injury  to  the  unprotected  observer.  Uncertainty  persists  within  both 
the  exposure  and  causal  processes  over  the  occurrence  of  given  events,  such  as  the  misdirection 
of  laser  energy  in  a  specific  direction  or  the  sustaining  of  an  ocular  injury. 

Typically,  the  hazard  posed  by  a  risk  event  can  be  defined  by  the  likeliness  of  its  occurrence  and 
its  consequent  impact  [17].  The  likeliness  of  an  adverse  event  can  be  defined  in  terms  of  the 
frequency  or  probability  with  which  it  occurs.  The  impact  of  a  given  event  depends  on  the  extent 
to  which  the  consequences  of  that  event  affect  the  system  under  consideration.  In  the  case  of  an 
ocular  injury,  the  impact  can  vary  from  minimal  impact  on  visual  acuity  to  a  total  loss  of  visual 
function.  The  bivariate  relationship  between  likeliness  and  impact  can  be  expressed  in  terms  of  a 
simple  “quadrant”  risk  model,  as  illustrated  in  Fig.  3.  In  this  simple  model,  an  adverse  event  can 
occur  with  (a)  a  high  likeliness  but  low  impact,  (b)  high  likeliness  and  high  impact,  (c)  low 
likeliness  and  high  impact,  or  (d)  low  likeliness  and  low  impact. 
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Figure  3:  Risk  Quadrant  for  an  Adverse  Event 
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The  purpose  of  the  ALARP  prineiple  is  to  identify  and  implement  suitable  risk  management 
control  procedures  so  as  to  ensure  that  any  potentially  adverse  events  occur  only  with  a  low 
likeliness  and  low  impact.  An  important  aspect  of  the  risk-based  approach  is  a  suitable  definition 
of  what  constitutes  a  low  likeliness  and  low  impact  event.  The  likeliness  of  an  event  may  be 
defined  by  a  fixed  value,  for  simple  models,  or  by  a  Probability  Distribution  Function  (PDF)  for 
more  complex  ones.  The  General  Risk  Model  thus  falls  naturally  into  a  probabilistic  structure, 
the  “Pe-Pi-Pod”  catastrophic  chain  of  events  structure,  shown  in  Fig.  2.  Here  the  “Pe-Pi”  couplet 
represents  the  exposure  process  and  the  “Pod”  element  represents  the  causal  process.  The  “Pe-Pi- 
Pod”  structure  provides  the  mathematical  basis  for  the  UK  probabilistic  laser  hazard  assessment. 

As  a  start  to  constructing  a  mathematical  model  of  the  probabilistic  laser  hazard  assessment,  the 
risk  chain  must  be  broken  down  into  its  individual  probabilistic  elements.  For  airborne  laser 
operations,  the  risk  of  ocular  injury  to  unprotected  persons  can  be  characterised  as  the  probability 
that  a  “catastrophic  chain  of  events,”  leading  to  an  adverse  outcome,  will  occur.  The  three  main 
components  of  such  a  risk  chain  are:  (i)  the  probability  of  laser  energy  being  fired  in  an 
inappropriate  direction  outside  the  Controlled  Range  Area  (Pe),  (ii)  the  probability  of  an 
unprotected  observer  being  irradiated  by  the  laser  energy  (Pi),  and  (iii)  the  subsequent  probability 
of  the  irradiated  observer  sustaining  an  ocular  injury  (Pod)- 

These  three  components  can  be  further  decomposed  into  five  distinct  elements:  i)  the  risk  of  laser 
energy  being  directed  outside  the  CRA;  ii)  the  risk  of  an  unprotected  observer  being  irradiated; 
iii)  the  risk  of  the  unprotected  observer  looking  in  the  direction  of  the  laser  energy  (ocular 
irradiation);  iv)  the  risk  of  atmospheric  scintillation  increasing  the  radiant  exposure  entering  the 
eye;  and  v)  the  risk  of  the  received  radiant  exposure  causing  ocular  damage.  Here,  the  first 
element  is  associated  with  Pe,  the  second  and  third  with  Pi,  and  the  fourth  and  fifth  with  Poo- 

Up  to  this  time,  UK  risk-based  Range  clearance  models  have  been  based  primarily  on  two  of  the 
three  components:  a  probabilistic  laser  pointing  error  model  (Pe),  coupled  with  a  probabilistic 
ocular  damage  model  for  1064  nm  laser  energy  (Pod)-  These  are  described  in  more  detail  in 
Sections  2.3  and  2.4,  respectively. 

In  contrast,  due  to  the  complexity  of  accurately  determining  the  probability  of  an  observer  being 
at  a  particular  location,  or  looking  into  the  laser  beam,  the  Pi  component  has  usually  been 
implemented  in  a  highly  simplified  version.  The  probability  of  an  observer  being  at  a  particular 
location,  and  the  subsequent  probability  of  that  observer  looking  into  the  laser  beam,  is  difficult 
to  define,  and  is  nominally  set  to  unity  for  practical  reasons.  That  is,  it  is  generally 
pessimistically  assumed  that  an  observer  is  always  irradiated  when  laser  energy  is  directed 
outside  the  CRA  and  that  that  observer  is  always  looking  in  the  direction  of  the  laser  source.  The 
inherent  pessimism  of  this  approach  can  then  be  mitigated  by  estimating  the  expected  number  of 
observers  sustaining  a  given  level  of  ocular  damage  in  any  given  laser  firing  direction,  based  on 
the  size  of  the  beam  footprint  and  the  local  population  density. 
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2.3  Probabilistic  Laser  Pointing  Error  Modelling 


The  goal  of  probabilistic  pointing  error  modelling  is  to  identify  a  pointing  error  Probability 
Distribution  Function  (PDF),  which  quantifies  the  probability  of  laser  energy  being  fired  in  any 
given  direction.  Clearly  this  function  will  vary,  depending  on  the  characteristics  of  the  laser 
system  and  supporting  aircraft  being  modelled.  The  UK  probabilistic  laser  pointing  error  model 
addresses  two  separate  regimes:  (a)  a  “fault- free”  regime,  when  the  directional  control  system  is 
operating  as  intended  against  a  distinct  well-defined  target,  and  (b)  a  “fault/failure”  regime, 
which  covers  situations  when  the  directional  control  system  fails  to  operate  as  intended.  The 
latter  might  occur  either  as  a  result  of  an  actual  electro-mechanical  failure,  or  due  to  a  failure  of 
the  system  to  maintain  the  laser  sightline  alignment  on  the  target,  for  example  during  rough 
weather,  when  the  aircraft  is  an  unstable  platform. 

Modelling  of  the  fault/failure  condition  is  an  important  feature  of  the  UK’s  risk-based  Range 
clearance  technique.  A  significant  parameter  is  the  probability,  Pp,  of  a  laser  system  fault  or 
failure  occurring  during  the  course  of  a  laser  firing  maneuver,  which  is  expected  to  be  low  for  a 
modem,  well-maintained  system.  A  suitable  value  for  the  probability  of  system  fault  or  failure 
can  be  established  using  appropriate  fault  or  failure  data,  including  mean-time-between-failure 
(MTBF)  statistics.  It  should  be  noted  that  the  fault/failure  condition  covers  only  accidental  or 
unintended  laser  pointing  errors,  and  not  deliberate  firing  of  the  laser  outside  of  the  Controlled 
Range  Area.  It  is  assumed  and  required  that  appropriate  steps  are  taken  to  disable  laser  firing 
immediately  after  a  fault  or  a  failure  has  occurred,  whether  manually  by  the  weapon  systems 
operator  (WSO)  or  automatically  by  built-in  fault  detection  mechanisms.  Consequently,  it  is 
expected  that  only  a  small  amount  of  laser  energy  would  potentially  escape  the  confines  of  the 
CRA  before  laser  firing  ceases. 

As  mentioned,  the  definition  of  an  appropriate  PDF,  covering  the  fault/failure  condition,  is 
dependent  on  the  aircraft-laser  system  architecture.  In  particular,  the  maximum  angular  drift, 
draax,  of  a  sightliue  error  while  the  laser  is  still  active  will  generally  be  a  function  of  the  system 
design  and  the  WSO  reaction  time.  In  the  absence  of  suitable  statistical  data,  an  appropriate 
distribution  function  for  laser  directional  errors  in  fault/failure  condition  can  be  established 
through  the  use  of  simulation  modelling.  MTBF  data  is  used,  in  conjunction  with  a  simplified 
“onion-skin”  model  (see  Fig.  4),  to  simulate  the  behaviour  of  the  laser  sightline  following  a  fault 
or  a  failure  in  different  parts  of  the  airborne  laser  designator  control  system. 
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Figure  4:  The  Selex  ES  ^‘Onion-Skin”  Fault/Failure  Condition  Model 


The  distribution  of  laser  pointing  errors  in  a  fault/failure  condition  depends  on  the  laser  system 
design  and  the  consequences  of  any  faults  or  failures  that  could  occur  in  the  directional  control 
mechanism,  all  of  which  should  be  described  in  the  LSP.  Examples  of  directional  control  system 
failures  include:  a  steering  gimbals  runaway,  in  which  the  laser  sightline  could  be  driven  rapidly 
away  from  the  target  position,  and  a  steering  gimbals  freeze,  in  which  the  laser  sightline 
direction  will  depend  on  the  aircraft  motion  relative  to  the  target.  Another  possibility,  depending 
again  on  the  laser  system  design,  could  involve  eccentric  cycling  of  the  laser  sightline  about  the 
target  as  a  result  of  a  partial  failure  in  the  directional  control  system.  The  choice  of  statistical 
distribution  representing  errant  laser  sightline  behaviour  is  hence  dependent  on  the  system  design 
characteristics,  together  with  the  quality  of  information  available  for  the  analysis.  Statistical 
functions  that  have  historically  been  used  to  describe  simple  fault  pointing  error  models  (and 
which  are  or  can  be  encoded  in  MATILDA)  include  the  uniform,  triangular  and  exponential 
distributions.  More  sophisticated  analyses  could  alternatively  be  developed,  depending  on  the 
resources  available  and  the  economic  justification  for  doing  so. 

Fault-Free  laser  pointing  errors  are  usually  modelled  as  a  circularly  symmetric  bivariate  Normal 
distribution,  which  may  be  further  expressed  in  terms  of  a  radial  pointing  error,  The 
associated  PDF  is  given  by  considering  the  probability  that  a  radial  error  lies  in  the  annulus 
between  the  angles  (j)  and  [18].  That  is 
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which  is  the  PDF  for  the  Rayleigh  distribution,  where  cl  is  the  variance.  The  probability 
P(0  <  ^)  is  given  by 
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From  the  fault/failure  probability,  Pp,  a  maximum  radial  laser  pointing  error  limit  may  be 

evaluated,  from  which  appropriate  clearance  restrictions  on  the  “Fault-Free”  laser  firing  envelope 
may  be  derived.  That  is 


^(^<«max)  =  1-exp 

=  ^-Pf 


(2.3) 


■Wr  (2.4) 

«max  =^X,V-l0g.^F  •  (2-5) 

In  the  UK  model  amax  is  a  maximum  fault-free  error,  such  that  the  probability  of  an  excessively- 
large  directional  control  error  is  small.  It  can  be  considered  a  threshold  between  normally- 
distributed  fault-free  laser  pointing  errors  and  fault/failure  condition  laser  sightline  errors. 


2.4  Probabilistic  Ocular  Damage  Modelling 

The  MATILDA  tool  currently  uses  the  UK  probabilistic  ocular  damage  model,  for  1064  nm  laser 
energy,  to  assess  the  probability  of  injury  for  unprotected  persons  inadvertently  exposed  to  stray 
laser  radiation.  The  model  is  based  on  an  experimentally-derived  log-normal  distribution 
relating  total  intra-ocular  (laser)  energy  (TIE)  with  the  probability  of  causing  a  Minimum 
Ophthalmoscopically  Visible  Lesion  (MOVL)  [3].  The  UK  probabilistic  ocular  damage  model 
has  also  been  combined  mathematically  with  a  probabilistic  scintillation  model,  which  predicts  a 
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log-normal  distribution  for  the  multiplicative  gain  in  laser  energy  density  as  a  result  of 
turbulence-induced  atmospheric  scintillation  effects. 


For  the  purposes  of  the  UK  probabilistic  model,  a  MOVL  is  defined  as  a  retinal  lesion  of  30  um 
diameter,  assuming  unaided  viewing  of  the  laser  energy.  The  rationale  behind  this  size  of  lesion 
is  that:  (a)  it  is  practically  the  smallest  lesion  size  that  can  be  detected  non-invasively  using  an 
ophthalmoscope,  and  (b)  it  is  considered  impractical  for  an  infrared  image  smaller  than  30  um  to 
be  formed  on  the  retina,  owing  to  the  limitations  of  the  human  eye  in  imaging  a  distant  infrared 
laser  source.  In  the  case  of  aided  viewing  of  the  laser  source  with  magnifying  optics,  it  is 
expected  that  the  diameter  of  any  laser  image  on  the  retina  would  be  generally  larger  than  the 
corresponding  unaided  image.  Consequently,  for  aided  viewing  of  the  laser  source,  the  MOVL 
diameter  is  increased  to  a  value  of  90  um. 

An  observer  sustaining  a  MOVL  on  the  most  sensitive  part  of  the  retina  (the  fovea)  could 
experience  a  minor  but  permanent  impairment  of  visual  acuity,  such  as  a  difficulty  in  reading 
fine  print.  A  MOVL  occurring  on  any  other  part  of  the  retina,  such  as  the  macula  or  para- 
macula,  may  have  even  less  effect  on  visual  acuity.  Given  other  (even  naturally  occurring) 
conditions  that  could  seriously  affect  visual  acuity,  up  to  and  including  total  blindness,  the  effect 
of  a  MOVL  can  be  considered  to  be  a  low  impact  event. 

It  should  be  mentioned  that  probabilistic  ocular  damage  models  have  also  been  developed 
independently  by  the  US  (AFRL).  These  are  “dose-response”  models  which  give  the  probability 
of  causing  a  MOVL  (response)  as  a  function  of  exposure  level  (dose)  for  1064  nm  [19]  and  1315 
nm  [20]  laser  radiation.  The  current  plan  is  to  include  these  US  ocular  damage  models  in  more 
advanced  versions  of  MATILDA,  with  the  user  given  the  option  of  choosing  the  appropriate 
model  for  their  particular  Range  and  training  scenario. 


2.5  UK  Expectation  Model 

As  described  in  Sections  2.3  and  2.4,  the  UK  MOD  has  detailed  probabilistic  models  for  two  of 
the  three  probabilistic  components  in  the  Pe-Pi-Pod  structure:  i)  a  combined  scintillation  and 
ocular  damage  model  for  1064  nm  pulsed  lasers  (Pod)  and  a  laser  pointing  error  model  (Pe), 
which  addresses  both  fault- free  laser  pointing  errors  and  fault/failure  condition  laser  sightline 
errors.  By  combining  these  with  a  suitable  population  distribution  model,  for  a  simplified  Pi 
component,  and  with  various  laser  system  parameters,  a  stochastically-based  “Expectation 
Model”  may  be  constructed,  which  incorporates  the  Pe-Pi-Pod  structure. 

The  UK  probabilistic  hazard  assessment  model,  or  UK  Expectation  Model,  is  based  on  an 
evaluation  of  the  expected  number  of  unprotected  observers  who  sustain  a  MOVL  during  an 
airborne  laser  firing  maneuver,  a  quantity  defined  as  Emovl-  The  Primary  Criterion  for  clearance 
of  a  laser  firing  maneuver  is  that  the  expected  number  of  cases  of  MOVL  does  not  exceed  a  pre¬ 
defined  maximum  acceptable  value,  Emovlmax-  The  Primary  Criterion  takes  into  account  both 
the  likeliness  of  laser  energy  being  misdirected  outside  the  CRA  and  the  potential  consequences 
of  an  unprotected  observer  being  irradiated.  Two  additional  precautions,  the  Secondary  and 
Tertiary  Precautions,  are  also  implemented  in  the  Expectation  Model,  to  guard  against  the 
possibility  of  a  low  likeliness,  high  impact  event,  in  which  a  high  probability  of  ocular  damage  to 
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an  irradiated  observer  could  be  masked  by  a  low  frequency  of  occurrence.  This  is  known  as 
“defense-in-depth.” 

The  overall  expectation  value,  ^movl  ,  of  an  unprotected  observer  sustaining  a  MOVL  as  a  result 
of  laser  training  operations  on  a  Range,  is  evaluated  in  two  steps:  i)  calculating  the  elemental 
(population-weighted)  expectation  value,  cmovl  ,  that  an  unprotected  observer  outside  the  CRA 
sustains  a  MOVL  from  a  single  pulse  of  laser  energy,  and  ii)  summing  these  single  pulse 
expectation  values  over  all  pulses  of  laser  energy  fired  during  the  operation  to  obtain  the  overall 
expectation  value. 

Now,  if  0  is  a  bivariate  random  variable  representing  the  azimuth  and  elevation  directions  ^  in 
which  the  laser  could  be  fired  relative  to  the  laser-target  vector  and  assuming  n  pulses  of  laser 
energy  are  fired  during  the  attack,  then  for  a  real-valued  function  g  [18], 

^MOVL(«)  =  XWL(g  (''(©)))  (2.6) 

i=\ 

where  g(^r(0))  is  a  random  variable  representing  the  number  of  persons  in  the  population 
suffering  a  MOVL  as  a  result  of  laser  training  operations.  In  Equation  2.6,  the  single  pulse 
expectation  value  e^ovL  defined  by 

^MOVL  (g(r(0)))  =  |j/(^)g(r(^))^/^  (2.7) 

e 


where  f{0)  is  the  laser  pointing  error  PDF  (Pe)  that  gives  the  probability  of  a  laser  pulse  being 
fired  in  the  direction  9 ,  and 


g(r{0))  =  n^(r{9))Q 

^MOVL  (*(r(e))) 


(2.8) 


represents  the  expected  number  of  observers  sustaining  a  MOVL  as  a  result  of  this  pulse.  Note 
that  the  two  factors  in  Eq.  2.8  represent  the  Pi  and  Pqd  components  of  the  risk  model.  The 
expected  number  of  persons  irradiated  when  the  laser  is  fired  in  the  direction  6  is  given  by 

(2.9) 

where  and  are  the  local  population  density  and  the  area  of  intersection  of  the 

laser  beam  with  the  ground  plane,  respectively.  Once  again  we  note  that  this  is  a  simplified 
version  of  the  Pi  component,  where  the  probability  of  an  irradiation  producing  ocular  exposure 
(probability  of  the  observer  looking  into  the  beam)  has  been  set  to  one. 

The  probability  that  an  ocular  exposure  produces  a  MOVL  (Pod)  is  given  by 
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(2.10) 


where 


and 


Q\_^uov^[h{r{0))) 


e  ^  dt 


^MOVL 


MOVL 


(/?(r(^)))  =  - 


-\og^[h(r{e)))  +  —  +b{d) 


2  A 


■\J\-\-  Cl 


2  2 

n 


(2.11) 


h{r[0)  =  the  corneal  laser  energy  density  at  distance  r  in  the  direction  ^  in  mJm'^ 
a  =  1.715 

Z)(^/)  =  8.5 169  + 3.73538  logio^/ 

d  =  the  diameter  of  the  laser  image  on  the  retina 
[  30//m  for  unaided  (naked-eye)  viewing 
[90//m  for  aided  viewing  with  magnifying  optics 
T]  =  standard  deviation  of  log-irradiance 
=  1.1 

In  a  full  probabilistic  evaluation,  the  elemental  expectations  of  ocular  damage  are  evaluated  for 
every  pulse  fired  during  the  attack  manoeuvre.  An  important  feature  of  the  full  probabilistic 
method  is  the  opportunity  for  ‘trade-off  between  the  component  probabilities.  That  is,  it  is 
possible  for  a  high  value  in  one  parameter  to  be  balanced  by  a  low  value  in  another.  Hence,  for 
example,  a  high  probability  that  laser  energy  could  irradiate  a  given  area  outside  the  CRA  could 
be  balanced  by  a  low  risk  that  anyone  would  be  present  within  that  area. 

Once  the  overall  expectation  value,  Emovl  ,  has  been  evaluated,  it  must  be  compared  with  the 
Primary  Criterion,  £'movlmax  ,  which  defines  the  maximum  acceptable  risk  of  ocular  damage 
occurring  in  the  population  during  laser  training  operations.  If  the  Primary  Criterion  is  exceeded, 
then  restrictions  on  the  laser  firing  envelope  are  imposed  to  reduce  risk  to  acceptable  levels.  A 
typical  maximum  acceptable  expectation  value  for  UK  Range  clearances  is  10'^  occurrences  of 
MOVL  per  attack.  In  comparison,  a  typical  NASA  acceptable  expectation  value,  for  injury  by 
falling  inert  debris,  is  10'^  injuries  per  launch.  Note  that  the  very  low  risk  levels  set  by  the 
Primary  Criterion  are  principally  achieved  by  ensuring  that  most  of  the  laser  energy  falls  within 
the  CRA.  Once  the  Primary  Criterion  is  met,  then  the  Secondary  and  Tertiary  Precautions  are 
applied,  to  identify  any  additional  restrictions  on  the  laser  firing  envelope. 

The  Secondary  Precaution  evaluates  the  expected  hazard  for  a  scenario  in  which  it  is  assumed 
that  laser  energy  is  misdirected  towards  a  populated  area  outside  the  CRA.  The  acceptable 
criterion  for  the  Secondary  Precaution  is  that  -  should  laser  energy  be  inadvertently  misdirected 
outside  the  CRA  -  the  expected  number  of  cases  of  MOVL  does  not  exceed  a  maximum 
conditional  expectation  value,  ^conmax-  For  the  UK,  a  typical  maximum  value  for  the 
Secondary  Precaution  is  on  the  order  of  10'^  to  10'"^  occurrences  of  MOVL  per  attack.  Finally, 
the  Tertiary  Precaution  assumes  that  an  unprotected  observer  has  actually  been  irradiated  by  a 
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single  pulse  of  laser  energy.  The  acceptable  criterion  for  the  Tertiary  Precaution  is  that  the 
probability  of  a  MOVL  for  an  irradiated  individual  does  not  exceed  a  pre-defmed  maximum 
value,  Pmovlmax-  For  the  UK,  a  typical  maximum  value  for  the  Tertiary  Precaution  is  lO  ' 
occurrences  of  MOVL  per  attack. 

Appropriate  restrictions  are  imposed  on  the  laser  firing  envelope  to  ensure  that  the  Primary 
Criterion,  Secondary  Precaution,  and  Tertiary  Precaution,  are  all  satisfied.  The  effect  of  the 
Tertiary  Precaution  is  to  impose  a  probabilistically  defined  Minimum  Separation  Distance 
(MSD)  between  the  laser  and  any  unprotected  observer  outside  the  CRA.  The  MSD  is  applied  in 
all  directions  in  which  the  laser  could  be  fired  before  the  laser  operation  is  inhibited  either 
automatically  by  the  laser  system  itself,  or  manually  by  the  operator.  In  this  respect,  the  MSD  is 
similar  to  the  NOHD,  albeit  much  smaller  in  magnitude.  An  unprotected  observer  located  at  the 
MSD  from  the  laser  would  be  at  a  non-zero  risk  of  sustaining  a  given  measureable  level  of  ocular 
damage,  if  irradiated.  The  role  of  the  MSD  is  similar  to  that  of  a  seat-belt  in  a  car.  The  purpose 
of  a  vehicle  seat-belt  is  to  provide  the  occupant  with  a  degree  of  protection  against  the  possibility 
of  a  more  serious  injury  in  the  event  of  an  accident:  its  primary  role  is  to  mitigate  the  possible 
consequences  of  an  accident  to  an  individual  rather  than  provide  total  protection  against  injury  or 
death.  In  a  similar  manner,  the  purpose  of  the  MSD  is  to  ensure  against  the  possibility  of  more 
serious  levels  of  ocular  damage  should  an  individual  observer  be  irradiated. 


2.6  UK  Partition  Model 

The  UK  Partition  Model  is  a  specific  implementation  of  the  UK  Expectation  Model  described 
above,  in  which  the  hazard  contributions  arising  from  fault- free  and  fault/failure  operation  of  the 
laser  directional  control  system  are  “partitioned”  and  evaluated  separately.  The  overall 
clearance  restrictions  defining  the  permitted  laser  firing  envelope  are  a  composite  of  the 
separately  and  sequentially  evaluated  restrictions  for  fault- free  and  fault/failure  operation.  As 
mentioned  previously,  the  Partition  Model  described  here,  and  used  in  the  MATILDA  tool,  was 
developed  to  perform  Range  safety  clearances  for  the  UK  TIALD  system. 

The  Partition  Model  is  fundamentally  a  geometric  implementation  of  the  hazard  analysis,  based 
on  where  in  the  terrain  laser  pulses  are  expected  to  fall.  Laser  pulses  emitted  during  fault-free 
laser  operation,  which  will  be  the  majority  of  pulses  fired  during  most  attack  runs,  will  be 
constrained  to  fall  within  the  CRA  by  geometric  restrictions  on  aircraft  operations  generated 
during  the  fault-free  analysis.  Consequently,  any  hazard  to  the  population  surrounding  the 
Range  will  come  from  the  relatively  small  number  of  pulses  which  could  be  emitted  during 
fault/failure  operation  and  which  might  fall  outside  the  CRA.  The  hazard  from  these  pulses  is 
determined  using  the  full  probabilistic  Expectation  Model  described  in  Section  2.5 

A  Fault-Free  Laser  Firing  Zone  (FFLFZ)  is  a  geometric  area  within  which  an  aircraft  flying  at  a 
designated  altitude  can  fire  freely  at  the  target.  For  any  given  attack  altitude,  the  FFLFZ  is 
defined  in  such  a  way  that  all  fault-free  laser  pointing  errors  (errors  less  than  ccmax)  produce  laser 
beams  that  fall  within  the  CRA.  Typically,  the  FFLFZ  are  evaluated  for  all  compass  directions 
around  the  target,  and  over  a  range  of  aircraft  altitudes,  in  accordance  with  laser  system  user 
requirements.  Each  designated  aircraft  altitude  produces  a  different  FFLFZ.  The  geometry  of  the 
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FFLFZ  calculation  is  similar  to  the  standard  risk  analysis  methods  currently  used  by  the  USAF  to 
establish  a  safe  laser  firing  envelope  [11].  However,  the  FFLFZ  calculation  is  designed  to 
maximise  the  range-to-target  at  which  the  laser  can  be  fired,  given  the  extent  of  Controlled 
Range  Area  available. 

The  hazard  analysis  for  fault/failure  operation  is  the  fully  probabilistic  portion  of  the  overall  laser 
hazard  assessment.  It  follows  computation  of  the  FFLFZ,  considers  laser  pointing  errors  in 
excess  of  Umax,  and  is  only  performed  for  specific  laser  firing  maneuvers  on  specific  aircraft 
attack  tracks.  Thus,  the  first  step  in  the  fault  hazard  analysis  is  to  define  the  aircraft  attack  track, 
attack  altitude,  and  laser  firing  positions.  A  check  is  then  made  to  ensure  that  the  attack  scenario 
complies  with  FFLFZ  restrictions.  Any  laser  firing  maneuvers  which  do  not  comply  with 
FFLFZ  restrictions  are  eliminated  prior  to  the  fault  hazard  analysis.  Next,  the  probabilistic 
Expectation  Model  is  used  to  evaluate  E’movl,  and  this  is  compared  to  the  maximum  acceptable 
value,  E'movlmax,  to  determine  whether  the  specified  laser  firing  maneuver  meets  the  Primary 
Criterion  for  safety  clearance.  Finally,  if  the  Primary  Criterion  is  met,  then  the  Secondary  and 
Tertiary  Precautions  are  applied,  to  identify  any  additional  restrictions  on  the  laser  firing 
envelope. 

The  Partition  Model  is  a  means  by  which  the  conditional  expectation  of  a  MOVL  in  an 
unprotected  population  can  be  evaluated,  and  appropriate  laser  firing  restrictions  defined,  such 
that  risks  produced  by  a  specified  laser  firing  maneuver  are  kept  within  acceptable  limits.  In 
terms  of  the  quadrant  risk  model  (Fig.  3),  the  FFLFZ  ensures  that  all  high  likeliness  events, 
whether  of  high  or  low  impact,  are  contained  with  the  controlled  Range  area.  Furthermore,  the 
subsequent  fault  hazard  analysis  ensures  that  appropriate  additional  restrictions  are  defined  to 
avoid  the  occurrence  of  low  likeliness,  but  potentially  high  impact  events.  In  this  respect,  the 
Partition/Expectation  Model  satisfies  the  ALARP  requirement. 


2.7  Computational  Model 

The  Partition/Expectation  Model  is  implemented  by  means  of  the  Computational  Model,  from 
which  the  applicable  laser  firing  restrictions  are  derived.  The  Computational  Model  is  composed 
of  three  main  modules,  executed  sequentially,  called  RBPROG,  CALCZONE,  and 
CALCFAULT.  In  these  modules  input  data  required  for  the  hazard  assessment  -  such  as  Range 
boundaries,  terrain  elevation  data,  target  position  on  the  Range,  local  demographics,  local 
geography  near  the  Range,  and  aircraft  and  laser  system  parameters  -  are  first  specified. 
Appropriate  preliminary  computations,  including  definition  of  the  Controlled  Range  Area 
(CRA),  are  then  performed,  followed  by  the  execution  of  the  Partition  model  as  described  above. 

The  initial  module  is  the  Range  Boundary  Program,  known  as  RBPROG  for  short.  The  main 
purpose  of  the  RBPROG  algorithm  is  to  define  the  Controlled  Range  Area,  which  will  be  used  in 
the  CALCZONE  module  to  define  the  FFLFZ.  The  CRA  is  a  sub-set  of  the  total  Range  area, 
which  is  “star-shaped”  with  respect  to  a  given  target.  A  CRA  is  defined  to  be  star-shaped  when 
any  radial,  cu,  emanating  from  the  target,  crosses  the  Range  boundary  only  once.  Frequently  the 
initial  Range  area  does  not  satisfy  the  star-shaped  condition,  so  a  portion  of  it  is  truncated  to 
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form  the  star-shaped  CRA.  Extra  coordinates  are  also  inserted  around  the  modified  CRA 
boundary  to  provide  appropriate  computation  points  for  the  CALCZONE  algorithm. 

The  second  module,  CALCZONE,  performs  the  fault-free  laser  hazard  analysis.  Specifically,  it 
calculates  the  FFLFZ  for  each  designated  target  within  the  CRA,  and  for  each  designated  aircraft 
altitude.  The  definition  of  an  FFLFZ  begins  with  a  set  of  radials  connecting  the  target  to  each  of 
the  CRA  boundary  points.  For  each  radial,  co,  emanating  from  the  target,  CALCZONE  computes 
a  maximum  laser  firing  range-to-target  (ground  range),  R(cl)),  such  that  fault-free  laser  pointing 
errors  (within  Umax  of  the  laser-target  vector)  remain  within  the  CRA.  This  requirement  results 
in  two  such  ranges-to-target,  Ru(co)  and  Ro(co),  corresponding  to  the  need  to  keep  “undershoot” 
and  “overshoot”  laser  pointing  errors,  respectively,  within  the  CRA,  as  shown  in  Fig.  5.  We 
should  note  that  azimuth  errors  are  generally  not  significant  compared  with  elevation  (i.e. 
undershoot  or  overshoot)  errors.  We  should  also  note  that  Fig.  5  shows  the  aircraft  firing  when 
not  directly  over  the  Range,  something  not  usually  done  during  US  laser  Range  tests.  This  is 
allowed  under  UK  laser  safety  policy,  due  to  their  small  Ranges,  but  only  on  fixed  approaches 
and  at  fixed  heights,  as  indicated  by  the  Fault-Free  Laser  Firing  Zones  (FFLFZ). 


A 


Figure  5:  Fault-Free  Overshoot  &  Undershoot 
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The  applicable  maximum  range-to-target,  R(co),  at  which  the  laser  may  be  fired  is  taken  to  be  the 
smaller  of  the  undershoot  and  overshoot  ranges;  that  is,  R(co)  =  min{i?„(co),  Rg  ((u)}.  Since  the 
firing  angle  to  the  target  will  vary  with  aircraft  height  (or  altitude),  H,  a  different  set  of 
maximum  firing  ranges  will  be  obtained  for  each  designated  aircraft  altitude.  The  FFLFZ  for 
each  aircraft  altitude  can  then  be  defined  as  the  set  {R{co):  coe  [0,2ji)}.  For  any  aircraft 
maneuver,  at  any  given  altitude,  the  FFLFZ  defines  the  maximum  range-to-target  at  which  the 
laser  may  be  fired,  assuming  fault- free  operation  of  the  laser  directional  control  system. 

The  third  module,  CALCFAULT,  performs  the  probabilistic  fault/failure  hazard  analysis  for  a 
specific  laser  attack  scenario,  to  determine  if  any  additional  restrictions  must  be  imposed  on  the 
laser  firing  envelope  permitted  by  the  FFLFZ.  As  mentioned  previously,  the  first  step  in  the  fault 
hazard  analysis  is  to  define  the  aircraft  attack  track,  altitude,  and  laser  firing  positions.  A  check 
is  then  made  to  ensure  that  the  laser  attack  scenario  complies  with  FFLFZ  restrictions  and  any 
laser  firing  maneuvers  which  do  not  comply  are  eliminated. 

Since  a  fault/failure  could  occur  at  any  point  during  the  course  of  the  cleared  laser  attack 
scenario,  a  large  number  of  failure  cases,  each  representing  a  possible  failure  of  the  directional 
control  system  at  a  different  point  along  the  attack  track,  must  potentially  be  evaluated  and  their 
overall  expectation  values  compared  to  the  Primary  Criterion.  Generally,  the  number  of  failure 
cases  evaluated  is  equal  to  the  number  of  pulses  fired  during  the  attack  scenario;  i.e.,  the  fault 
hazard  analysis  is  performed  for  a  possible  failure  at  each  of  the  laser  firing  positions.  For  each 
laser  pulse  emitted  after  the  fault/failure,  the  CALCFAULT  algorithm  evaluates  a  corresponding 
expectation  value,  cmovl,  that  a  MOVL  will  occur  in  the  unprotected  population  surrounding  the 
CRA.  The  number  of  pulses  emitted  after  a  fault  or  failure  has  occurred  depends  on  the  pulse 
repetition  frequency  (PRF)  and  the  length  of  time  required  for  the  laser  to  cease  firing. 
Consequently,  the  overall  expectation  value,  Emovl,  for  a  particular  failure  case,  is  the  sum  of  the 
individual  pulse  cmovl  values  for  the  period  of  time  during  which  the  laser  continues  to  fire,  and 
before  laser  firing  is  inhibited. 

Restrictions  on  laser  firing  are  subsequently  imposed  on  those  portions  of  the  aircraft  attack  track 
for  which  the  calculated  value  of  £'movl  exceeds  the  acceptable  limit.  Additional  laser  firing 
restrictions  may  also  be  imposed  on  those  portions  of  the  aircraft  maneuver  that  bring  the  laser  to 
within  the  applicable  MSD  of  potentially  vulnerable  populated  areas.  The  Computational  Model 
requires  a  significant  amount  of  geographic  and  demographic  data  in  order  to  compute  an 
optimum  set  of  restrictions  for  any  given  laser  firing  operation  during  a  training  maneuver.  The 
MATILDA  tool  is  designed  to  provide  a  suitable  software  platform  for  performing  these 
calculations  and  displaying  the  results,  based  on  geographic  information  system  technology 
tailored  to  the  needs  of  airborne  military  laser  hazard  assessment. 


3  THE  MATILDA  TOOL 
3.1  Genesis  of  MATILDA 

During  the  early  1990s,  the  USAF  identified  the  need  for  an  automated  software  tool  to  aid 
Range  Safety  Officers  in  establishing  laser  Range  safety  clearances.  The  result  was  the  Laser 
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Range  Management  Software  (LRMS)  tool,  which  the  USAF’s  Optical  Radiation  Safety  team 
has  used  for  nearly  two  decades  to  establish  MPE-based  Range  safety  clearances  for  all  of  the 
USAF  active  Ranges.  During  the  late  1990s,  the  USAF  began  attempts  to  understand  the  safety 
implications  of  developing  High  Energy  Laser  systems.  Initial  developments  followed  the 
accepted  standard  risk  analysis  approach,  but  it  was  recognized  by  AFRL  that  eventually  a  PRA- 
based  tool  would  be  necessary  to  deal  with  HEL  hazard  analysis  in  support  of  Range  testing, 
training,  and  operational  deployment.  It  was  at  this  time  that  discussions  with  the  UK  MoD 
began,  with  the  goal  of  leveraging  their  laser  PRA  modelling  capabilities. 

Early  discussions  focused  on  each  organization’s  respective  methodologies  for  laser  safety  and 
hazard  analysis.  After  consideration,  it  was  agreed  that  the  best  way  to  clarify  US  understanding 
of  the  UK  PRA-based  approach  was  to  actually  implement  one  of  the  existing  UK  models,  using 
AFRL  expertise  in  development  of  advanced  software  tools  for  laser  hazard  analysis.  By 
approaching  the  collaboration  in  this  manner,  the  USAF  has  realized  its  goal  of  understanding 
UK  methodology,  and  the  UK  has  realized  its  goal  of  obtaining  an  integrated  version  of  their 
laser  PRA  analysis  methodology  in  a  single  analytical  tool.  It  was  decided  that  the  best 
candidate  for  this  effort  would  be  the  PRA  partition  model  for  the  UK  Thermal  Imaging 
Airborne  Laser  Designator  (TIALD)  system.  The  UK  also  suggested  that  the  new  software  be 
called  the  Military  Advanced  Technology  Integrated  Laser  hazarD  Assessment  (MATILDA) 
tool. 


3.2  MATILDA  Development  and  Testing 

The  UK  MoD’s  TIALD  model  consisted  of  several  HP  BASIC  programs  that  had  been 
developed  and  refined  over  many  years.  Each  program  was  a  stand-alone  code  whose  results 
were  manually  fed  to  the  next  program  in  the  analysis  chain.  Geographic  input  data  were 
manually  extracted  from  British  Ordnance  Survey  maps.  Although  an  independent 
implementation  of  TIALD  model  algorithms  has  been  created  in  MATILDA,  the  results  of  these 
original  codes  have  proven  valuable  as  a  cross-check  on  MATILDA  results. 

During  MATILDA  development,  the  UK  MoD  has  supplied  the  mathematical  models, 
algorithms,  and  corresponding  documentation,  while  the  USAF  has  been  the  primary  software 
developer.  A  lesson  learned  from  earlier  generations  of  laser  codes  was  to  encapsulate 
computational  logic/code  into  a  non-proprietary  language  to  avoid  continuous  porting  of  the  code 
to  the  latest  fad  in  software  tools.  FORTRAN  has  long  been  that  language  but  has  been  losing 
ground  to  C  and  C++  over  the  last  couple  of  decades.  Thus  MATILDALib  is  an  ANSI  C++ 
library  that  encapsulates  all  of  the  computational  code  and  logic  required  of  RBPROG, 
CALCZONE,  and  CALCFAULT.  Using  C/C++  provides  MATILDALib  the  speed  advantages 
inherent  in  C/C++  codes  while  also  providing  portability  to  most  modem  computing  platforms. 

Although  MATILDA  started  out  as  a  computational  tool,  and  retains  a  computational  focus,  the 
need  to  display  the  results  graphically  became  readily  apparent  during  the  initial  implementation 
of  the  RBPROG  algorithms.  The  original  HP  BASIC  codes  implemented  a  scaled  version  of  the 
British  National  Grid  Coordinate  system.  Early  discussions  between  the  UK  MoD  and  USAF 
had  already  emphasized  the  need  to  leverage  standard  Geographic  Information  System  (GIS) 
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format;  however,  budgets  on  both  sides  were  limited.  Fortunately  for  us,  the  Idaho  State 
University  (ISU)  Geospatial  Software  Lab  (GSL)  had  similar  constraints  several  years  earlier, 
when  they  launched  the  MapWindow  Open  Source  development  effort.  After  a  quick  study  of 
the  ISU  GSL  capabilities,  it  was  decided  that  MATILDA  should  consist  of  a  set  of  plug-ins  to 
MapWindow. 

The  MATILDA  development  team  has  made  a  concerted  effort  to  keep  the  computational  engine 
of  the  tool,  MATILDALib  ANSI  C++,  completely  independent  of  the  MapWindow  code. 
Separating  the  Graphics  User  Interface  (GUI)  from  the  computational  engine  has  a  number  of 
advantages.  It  simplifies  coding,  de-bugging,  and  updates  of  the  different  modules  of  the  tool, 
enhances  portability  to  different  platforms,  and  allows  MATILDALib  to  be  leveraged  by  any 
GIS  application/system.  This  is  important  because,  just  as  the  MATILDA  project  has  leveraged 
MapWindow  efforts,  future  PRA  applications  will  be  able  to  leverage  the  MATILDA  effort. 

Due  to  the  differing  requirements  for  generating  Range  clearance  information,  it  was  agreed  that 
there  should  actually  be  three  different  versions  of  MATILDA.  The  first  (MATILDA  “User”) 
would  be  for  basic  users,  to  simply  determine  whether  a  particular  mission  was  allowed,  based 
on  an  established  Range  clearance,  and  with  little  or  no  ability  to  change  any  of  the  previously 
verified  and  tested  input  parameters.  The  second  (MATILDA  “User  Plus”)  would  be  for  a  more 
advanced  user  at  the  Range,  to  incorporate  limited  changes  to  the  target  position  and  attack  track. 
The  third  (MATILDA  “Pro”)  would  be  the  full  model  for  expert  analysts,  who  would  be 
responsible  for  setting  the  parameters  needed  for  the  Range  safety  analysis  and  then  performing 
the  analysis  to  establish  the  initial  Range  clearance. 

A  detailed  description  of  the  algorithms  and  analysis  procedures  used  in  each  of  the  three  main 
MATILDA  computational  modules,  RBPROG,  CALCZONE,  and  CALCFAULT,  is  given  in 
Sections  3.4  to  3.6,  respectively.  In  addition,  to  illustrate  the  results  given  by  each  module, 
MATILDA  Pro  Version- 1.6.2  was  used  to  perform  a  hazard  analysis  for  a  sample  case:  a 
hypothetical  airborne  laser  designator  used  in  an  attack  maneuver  during  a  training  scenario  at 
the  UK’s  Tain  Range  in  northern  Scotland.  Prior  to  execution  of  the  three  main  modules, 
however,  a  large  amount  of  data  must  be  input,  and  some  data  transformations  and  set-up 
procedures  must  be  completed.  Thus,  in  Section  3.3,  we  begin  our  detailed  description  of  code 
operations  by  describing  the  types  of  input  data,  data  transformations,  and  set-up  procedures 
required  to  initiate  a  MATILDA  analysis,  as  well  as  the  sample  case  used  for  illustration. 


3.3  MATILDA  Inputs,  Set-Up  Procedures,  and  Sample  Case 

There  are  five  types  of  input  data  required  for  a  full  MATILDA  analysis:  i)  population  data  for 
the  urban  and  rural  areas  surrounding  the  Range;  ii)  laser  system  parameters;  hi)  aircraft  attack 
track  data;  iv)  terrain  mapping  and  terrain  elevation  data;  and  v)  geometric  and  geographic  data 
defining  the  range  and  areas  surrounding  it.  The  latter  includes  Range  boundaries,  target  position 
on  the  Range,  location  and  boundaries  of  Urban  Areas,  and  natural  geographic  features  such  as 
rivers,  lakes,  and  coastlines.  Both  the  Urban  Areas  and  the  initially  defined  Controlled  Range 
Area  (CRA)  must  be  represented  in  the  input  data  by  predefined  closed  boundary  polygons.  The 
closed  boundary  polygon  defining  the  initial  CRA  may  represent  the  boundary  of  the  total  Range 
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area,  or  may  be  some  subset  of  it,  constructed  by  the  analyst  using  other  natural  and  man-made 
geographic  features  such  as  roads,  fences,  and  coastlines. 

The  five  data  types  described  above  may  initially  be  available  to  the  analyst  in  a  variety  of 
physical  units.  For  consistency  a  single  system  of  units  must  be  used  in  computations.  The 
Meters,  Kilograms,  Seconds  (MKS)  unit  system  has  been  chosen  for  MATILDA  and,  with  some 
specific  exceptions,  all  data  not  initially  available  in  MKS  units  are  transformed  into  them  prior 
to  input.  Another  potential  problem  is  that  the  latter  three  data  types  (items  (iii)  -  (v)  above), 
being  geographic  in  nature,  may  initially  be  available  in  a  variety  of  coordinate  systems, 
typically  local  (grid-based)  map  coordinate  systems.  For  computational  consistency  these  are 
transformed  into  a  single  common  coordinate  system,  termed  the  MATILDA  Internal  Coordinate 
System  (MICS).  In  order  to  bring  such  local  map  data  into  the  MICS,  three  different  coordinate 
transformations  are  performed,  as  shown  schematically  in  Fig.  6. 


Figure  6:  MATILDA  Coordinate  Transformations 


The  full  mathematical  details  of  the  coordinate  transformations  listed  in  Fig.  6  are  beyond  the 
scope  of  this  report;  but  may  be  found  in  Annex  A  of  Ref  [18].  Here  we  give  only  a  brief 
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summary  of  the  transformation  process.  The  local  map  coordinates  are  transformed  first  into 
Geodetic  (latitude,  longitude,  altitude)  coordinates.  Next  the  Geodetic  coordinates  are 
transformed  into  Geocentric  coordinates,  a  Cartesian  (x,y,z)  coordinate  system  with  origin  at  the 
center  of  the  Earth  and  z-axis  oriented  towards  the  North  Pole.  Finally  Geocentric  coordinates 
are  transformed  into  the  MICS,  which  is  a  Cartesian  coordinate  system  local  to  the  Range,  where 
X  is  east,  y  is  north,  z  is  up,  and  the  origin  is  at  the  target  center.  Fig.  7  illustrates  the  relationship 
between  Geocentric  and  MICS  coordinates. 


Figure  7:  Geocentric  and  MICS  Coordinates 


Referring  once  again  to  Fig.  6,  we  should  note  that  WGS84  is  the  Global  Positioning  System 
(GPS)  standard  which  is  used  by  most  current  global  mapping  systems.  The  transformations 
bring  data  from  all  sources  to  a  common  WGS84  Geocentric  system  and  then  transform  this  data 
into  MICS.  When  computations  are  completed.  Range  clearance  data  must  be  transformed  from 
MICS  back  into  a  local  map  coordinate  system,  using  the  right-hand  path  of  the  Figure.  Working 
backwards,  MICS  is  transformed  into  WGS84  Geocentric,  then  into  WGS84  Geodetic,  and 
finally  into  local  map  coordinates  using  the  Universal  Transverse  Mercator  (UTM)  map 
projection.  The  latter  has  been  used  by  the  U.S.  military  to  map  a  considerable  portion  of  the 
Earth’s  surface. 

After  data  input  and  data  transformations  are  complete,  there  is  one  additional  set-up  procedure 
which  must  be  performed  prior  to  initiating  the  MATILDA  analysis  with  RBPROG:  generation 
of  a  mathematical  model  termed  the  Terrain  Profile  Surface,  using  the  digital  terrain  elevation 
data  and  target  location  supplied.  The  Terrain  Profile  Surface  is  a  simplified  representation  of 
the  terrain  elevation  in  the  area  surrounding  the  target.  This  theoretical  surface  has  the  target 
location  as  its  lowest  point.  From  that  point  it  rises,  in  terrain  steps  of  steadily  increasing  height, 
as  we  move  radially  outward  from  the  target  in  all  directions.  Terrain  step  heights  are  defined 
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within  an  angular  sector  at  given  radial  distances  from  the  target.  Figure  8  illustrates  a  sample 
terrain  profde  “web”  in  which  the  terrain  steps  are  defined  at  one  kilometer  radial  intervals, 
within  10°  sectors  centered  on  the  target.  The  CRA  boundary  is  indicated  by  a  dashed  line.  The 
height  of  each  step  in  an  angular  sector  is  defined  by  the  maximum  spot  height  of  the  terrain 
lying  beneath  that  step,  or  by  the  height  of  the  previous  step  nearer  the  target,  whichever  is 
greater.  The  end  result  is  that  the  surrounding  terrain  heights  are  always  below  the  surface. 


Figure  8:  Terrain  Profiie  “Web” 


The  Terrain  Profile  Surface  provides  a  means  of  ensuring  against  the  possibility  of  short-range 
irradiation  of  elevated  terrain  areas  under  the  laser — target  vector,  where  unprotected  persons 
might  be  present.  It  is  used  in  the  CALCZONE  module,  to  aid  in  the  proper  definition  of  the 
Fault-Free  Laser  Firing  Zones  (FFLFZ),  which  can  be  affected  by  the  underlying  terrain  step 
profile.  This  will  be  discussed  in  more  detail  in  Section  3.5. 

We  conclude  Section  3.3  by  describing  the  sample  case  which  will  be  used  to  illustrate  the 
results  of  the  main  MATILDA  modules  in  the  next  three  sections:  a  hypothetical  airborne  laser 
designator  used  in  an  attack  maneuver  during  a  training  scenario  at  the  UK’s  Tain  Range  in 
northern  Scotland.  For  this  sample  case  it  is  assumed  that  the  hypothetical  airborne  laser 
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designator  is  a  multiple  pulse  “all-round  line-of-sight”  system  mounted  on  a  single-seat  strike 
aircraft. 

Important  laser  input  parameters  include:  i)  pulse  energy,  peak  irradiance,  and  beam  energy 
distribution;  ii)  other  key  beam  parameters  such  as  wavelength,  beam  divergence,  pulse  duration, 
and  pulse  repetition  frequency;  iii)  Fault-Free  and  Fault  Pointing  Error  Distributions;  and  iv)  the 
Probability  of  Fault  for  the  laser  system.  These  laser  system  parameters  are  obtained  by  the  laser 
system  manufacturer,  through  testing  of  multiple  laser  units  and  averaging  of  performance  data. 
The  data  is  provided  to  laser  safety  officers  in  the  Laser  Safety  Paper  (LSP),  described  in  Section 
2. 1 .  The  laser  system  input  parameters  for  our  sample  case  are  summarised  in  Table  1 . 


Table  1:  Input  Parameters  for  the  Hypothetical  Airborne  Laser  Designator 


Parameter 

Parameter  Value 

Fault-Free  Pointing  Error  Distribution 

Gaussian 

Fault-Free  RMS  Pointing  Error 

5  mrad 

Fault  Pointing  Error  Distribution 

Uniform 

Maximum  Fault  Pointing  Error 

0.35  rad  (20  deg) 

Probability  of  Fault 

10”"^  per  attack 

Laser  Switch-off  Time  in  Fault  Condition 

3  seconds 

Laser  Wavelength 

1064  run 

Pulse  Energy 

200  mJ 

Beam  Divergence 

0.124  mrad 

Pulse  Duration 

10  ns 

Pulse  Repetition  Frequency 

20  Hz 

In  addition  to  laser  system  parameters,  geographic  input  data  were  also  loaded  for  our  sample 
case,  including  Range  boundaries  for  the  Tain  Range  (equivalent  to  the  initial  CRA),  target 
position  on  the  Range,  location  and  boundaries  of  nearby  Urban  Areas,  and  local  terrain  and 
coastlines  near  Tain  Range,  which  borders  on  the  North  Sea.  Geometric  inputs  of  this  kind  are 
represented  visually  by  shapes  on  layers  loaded  by  the  analyst,  and  the  results  for  this  case  are 
shown  in  Fig.  9.  Terrain  elevation  data  for  the  region  surrounding  Tain  Range  were  also  input 
and  used  with  the  target  location  to  create  the  Terrain  Profile  Surface,  and  population  data  were 
input  for  each  of  the  nearby  Urban  areas.  Data  on  the  aircraft  attack  track  were  not  input  until 
the  end  of  the  CALCZONE  module,  as  discussed  in  Section  3.5.  Once  data  input  and  set-up 
procedures  are  complete,  the  three  main  modules,  RBPROG,  CAECZONE,  and  CAECFAUET, 
are  executed  sequentially. 
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Figure  9:  The  MATILDA  Pro  Primary  Geographic  Inputs 


3.4  RBPROG  Analysis 

The  main  purpose  of  the  RBPROG  module  is  to  define  a  Controlled  Range  Area  (CRA)  which  is 
suitable  for  use  in  the  CALCZONE  module,  where  the  Fault-Free  Laser  Firing  Zones  (FFLFZ) 
are  defined.  The  initially  defined  CRA,  input  during  code  start-up,  may  or  may  not  be  suitable 
for  CALCZONE.  A  suitable  CRA  is  defined  to  be  a  sub-set  of  the  initial  CRA  which  is  “star¬ 
shaped”  with  respect  to  a  given  target;  i.e.,  any  radial  emanating  from  the  target  crosses  the  CRA 
boundary  only  once.  The  RBPROG  analysis  achieves  a  suitable  CRA  with  6  steps:  i)  the  “star¬ 
shaped”  condition,  ii)  the  “points  of  closest  approach”  condition,  iii)  the  “terrain  profile” 
condition,  iv)  the  “urban  area”  condition,  v)  the  “small  increment”  condition,  and  vi)  the 
“undershoot/overshoot”  condition. 

As  stated  above,  the  star-shaped  condition  ensures  that  any  radial  drawn  outward  from  the  target 
position  crosses  the  CRA  boundary  only  once.  To  assess  the  star-shaped  condition,  we  first 
assume  that  the  boundary  points  for  the  initial  CRA  are  listed  in  a  counter  clockwise  direction 
relative  to  the  target;  i.e.,  with  angular  bearings  increasing  from  0  to  360  degrees.  If  the  bearings 
of  each  consecutive  boundary  point  form  a  strictly  increasing  set,  then  the  CRA  is  star-shaped. 
On  the  other  hand,  if  at  any  point  the  bearing  decreases,  before  increasing  again,  then  a  ‘switch- 
back’  has  occurred  and  the  CRA  is  not  star-shaped.  The  presence  of  a  switch-back  indicates  that 
a  radial  line  from  the  target  can  cut  the  CRA  boundary  at  more  than  one  point.  The  star-shaped 
algorithm  identifies  and  removes  switch-backs  from  the  list  of  CRA  boundary  points.  In 
removing  a  switch-back,  a  new  boundary  co-ordinate  is  created  and  inserted  into  the  appropriate 
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point  in  the  list.  All  subsequent  boundary  co-ordinates,  up  to  the  point  where  the  switch-back 
ends,  are  removed  from  the  list.  Figure  10  illustrates  this  concept  for  Tain  Range  and  shows  that 
part  of  the  initial  CRA  area  is  excluded  to  satisfy  the  star-shaped  condition. 


Excluded 


Figure  10:  Star-Shaped  Condition 


For  any  CRA  boundary  line  segment,  the  point  of  closest  approach  between  the  Range  boundary 
and  the  target  sets  the  worst  case  minimum  safe  firing  range  for  the  aircraft.  The  purpose  of  the 
points  of  closest  approach  condition  is  to  insert  CRA  boundary  points  at  the  point  of  closest 
approach  for  each  line  segment,  unless  these  points  are  already  in  the  CRA  boundary  list.  These 
additional  boundary  points  are  used  in  CALCZONE  to  ensure  that  a  Fault-Free  Laser  Firing 
Zone  contour  point  is  calculated  for  each  worst  case  minimum  safe  firing  range.  The  point  of 
closest  approach  for  a  line  segment  will  be  either:  i)  one  of  the  two  end  points  of  the  line 
segment,  or  ii)  the  point  of  intersection  between  the  line  segment  and  the  target  normal.  Figure 
1 1  illustrates  the  process. 
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Figure  11:  Points  of  Closest  Approach  Condition 


We  have  already  discussed  the  creation  of  a  Terrain  Profile  Surface,  and  how  terrain  steps  are 
defined  in  angular  sectors  centered  on  the  target.  The  purpose  of  the  terrain  profile  condition  is  to 
insert  additional  coordinates  at  the  points  of  intersection  between  the  line  segments  making  up 
the  CRA  boundary  and  the  terrain  profile  sector  radials,  so  that  the  different  analytical  layers 
making  up  the  overall  clearance  solution  can  be  properly  aligned  geographically.  Figure  12 
illustrates  the  process. 
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Figure  12:  Terrain  Profile  Condition 


For  the  CALCFAULT  module,  laser  firing  restrictions  calculated  for  the  fault/failure  condition 
are  partly  driven  by  hazards  posed  to  observers  in  populated  Urban  Areas  outside  the  CRA.  The 
urban  area  condition  adds  CRA  boundary  points  that  correspond  to  points  of  intersection 
between  the  boundary  and  radials  from  the  target  that  bound  each  urban  area  in  the  vicinity  of 
the  Range. 

The  Urban  Area  bounding  radials  are  defined  by  the  ‘right-hand’  and  ‘left-hand’  bearings 
(^iN,  ^Ax)  of  the  Urban  Area  limits  with  respect  to  the  target,  augmented  by  the  fault/failure 
pointing  error,  s.  That  is,  the  Urban  Area  bounding  radials  are  defined  by  the  bearings 
(^MiN  ■  Figure  13  illustrates  this  process. 
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Figure  13:  Urban  Area  Condition 


The  small  increment  condition  ensures  that  the  bearings  of  consecutive  CRA  boundary  points 
differ  by  no  more  than  0.5  degrees.  This  smooths  the  calculation  of  the  FFLFZ  contours. 
Additional  boundary  points  are  added  as  required  to  ensure  this.  Figure  14  illustrates  the  process. 
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Figure  14:  Small  Increment  Condition 
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As  discussed  in  Section  2.7,  CALCZONE  defines  the  Fault-Free  Laser  Firing  Zones  (FFLFZ) 
based  on  the  need  to  keep  “undershoot”  and  “overshoot”  laser  pointing  errors  within  the  CRA,  as 
shown  in  Fig.  5.  Proper  FFLFZ  calculations  require  that  each  CRA  boundary  point 
corresponding  to  the  maximum  undershoot  must  be  “mirrored”  by  a  diametrically  opposite 
boundary  point,  relative  to  the  target,  corresponding  to  the  maximum  overshoot.  The 
undershoot/overshoot  condition  ensures  that  new  boundary  points  are  added  to  the  CRA  to 
satisfy  this  requirement,  assuming  such  “mirror  points”  do  not  already  exist.  Figure  15  illustrates 
the  process.  Undershoot  and  overshoot  restrictions,  and  their  connection  to  the  Terrain  Profile 
Surface,  are  discussed  in  more  detail  in  Section  3.5. 
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Figure  15:  Undershoot/Overshoot  Condition 


After  completion  of  the  undershoot/overshoot  step,  a  final  check  is  made  on  the  CRA  boundary 
point  list,  as  amended  by  the  six  RBPROG  steps  described  above.  The  final  check  ensures  that 
the  point  list  is  in  sequential  order,  with  respect  to  angular  bearing  to  the  target,  and  eliminates 
duplicate  points.  Collectively  the  six  steps  result  in  a  set  of  CRA  boundary  coordinates  that  will 
be  used  subsequently  by  CALCZONE  to  calculate  the  permissible  laser  firing  distances  at 
various  compass  points  around  the  target,  i.e.,  the  Fault-Free  Laser  Firing  Zones.  The  final  CRA 
for  our  sample  case  is  shown  in  Fig.  16.  The  CRA  boundary  is  in  red  and  black,  with  the  black 
line  representing  an  alteration  to  the  Range  boundary  needed  to  satisfy  the  star-shaped  condition. 
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Figure  16:  RBPROG  Analysis  Result:  CRA  with  Additional  Boundary  Points 


3.5  CALCZONE  Analysis  and  Attack  Track  Definition 

The  second  computational  module,  CALCZONE,  performs  the  fault-free  laser  hazard  analysis; 
i.e.,  it  calculates  the  Fault-Free  Laser  Firing  Zones  (FFLFZ)  for  each  designated  aircraft  altitude, 
and  the  specified  target  position,  using  the  CRA  defined  in  RBPROG.  The  general  procedure  for 
this  has  been  previously  described  in  Section  2.7.  For  any  aircraft  attack  track,  at  any  given 
altitude,  the  corresponding  FFLFZ  defines  the  maximum  range-to-target  at  which  the  laser  may 
be  fired,  assuming  fault-free  operation  of  the  laser  directional  control  system.  The  FFLFZ 
provide  the  analyst  and  Range  personnel  with  a  fault-free  operating  envelope,  which  ensures  that 
laser  energy  will  not  go  outside  the  CRA  unless  a  fault/failure  occurs. 

We  begin  our  description  of  CALCZONE  analysis  procedures  by  briefly  reviewing  the 
discussion  of  fault-free  laser  pointing  errors,  given  in  Section  2.3.  We  assume  that  the  targeting 
system  has  a  fault- free  laser  pointing  error,  (j),  with  a  corresponding  fault- free  laser  pointing  error 
distribution,y(<^).  The  maximum  fault-free  laser  pointing  error  is  ^  =  «niax  •  defined  in 


32 

Distribution  A:  Approved  for  public  release;  distribution  unlimited.  PA  Case  No:  TSRL-PA-20 14-0021 


Eq.  2.5,  the  value  of  is  ealculated  using  the  Threshold  Probability  for  fault/failure,  Pf, 

which  is  determined  from  the  laser  system  hazard  assessment  and  provided  in  the  LSP.  For  any 
particular  aircraft  attack  track,  the  fault-free  laser  pointing  error  could  produce  either  an 
undershoot  or  an  overshoot  of  the  target. 

As  we  recall  from  Section  2.7,  defining  the  FFLFZ  first  requires  calculation  of  the  undershoot 
and  overshoot  ranges,  and  Roico),  corresponding  to  each  possible  aircraft  altitude  and  to 

each  radial,  co,  between  the  target  and  a  CRA  boundary  point.  These  are  the  maximum  ranges- 
to-target  at  which  the  laser  can  be  fired,  in  order  to  keep  to  keep  undershoot  and  overshoot  laser 
pointing  errors,  respectively,  within  the  CRA,  as  shown  in  Fig.  5.  The  overall  maximum  firing 
range,  R(co),  is  taken  to  be  the  smaller  of  the  undershoot  and  overshoot  ranges;  that  is,  R(co)  = 
min{i?„(co),  Ro  (cu)}.  The  FFLFZ  for  each  aircraft  altitude  can  then  be  defined  as  the  set 
coe  [0,27i)},  covering  all  possible  radials  to  any  boundary  point. 

We  now  consider  the  Target  -  Range  Boundary  geometry  produced  by  both  overshoot  and 
undershoot  of  the  target,  due  to  the  fault-free  laser  pointing  error,  (f).  We  assume  that  the  aircraft 
is  flying  a  level  attack  track,  at  constant  altitude  or  height  H,  and  that  the  attack  track  is  heading 
directly  at  the  target,  as  shown  in  Fig.  5.  The  attack  track  thus  lies  within  the  vertical  plane 
defined  by  the  surface  normal  at  the  target,  and  the  line  connecting  two  “mirrored”  CRA 
boundary  points,  such  as  those  shown  in  Fig.  15.  We  designate  the  near  and  far  boundary  points 
as  BN  and  BF,  respectively.  The  range-to-target  for  an  attacking  aircraft  can  be  defined  in  either 
of  two  ways:  as  a  slant  range  along  the  laser-target  vector,  or  as  a  ground  range  along  a  vector 
connecting  the  target  to  a  point  directly  under  the  aircraft.  In  FFLFZ  calculations  we  will  use  the 
ground  range-to-target,  7?^ ,  measured  along  the  curved  earth  surface. 

Figure  17  shows  the  overshoot  geometry  for  an  Aircraft,  A,  at  height  H,  with  a  (curved  earth) 
ground  range-to-target,  R^ .  We  wish  to  ensure  that  the  overshoot  buffer  angle  (i.e.,  the  angle 

between  the  aircraft-target  and  aircraft-BF  vectors)  is  greater  than  or  equal  to  the  maximum 
fault-free  laser  pointing  error.  In  this  case,  the  laser  energy  will  fall  between  the  target,  T,  and 
the  far  boundary  point,  BF,  i.e.  within  the  CRA.  As  the  aircraft  approaches  the  target, 
decreases,  and  the  overshoot  buffer  angle  increases.  When  the  overshoot  buffer  angle  is  equal  to 
the  maximum  fault-free  laser  pointing  error,  (j)  =  amax,  as  shown  in  Fig.  17,  then  the  aircraft 
ground  range  equals  the  overshoot  range,  i.e.,  R^  =  Rq.  Ground  ranges  smaller  than  the 

overshoot  range  give  buffer  angles  larger  than  amax,  so  if  Ro  is  the  maximum  firing  range,  then 
any  laser  overshoots  are  safely  contained  within  the  CRA. 


33 

Distribution  A:  Approved  for  public  release;  distribution  unlimited.  PA  Case  No:  TSRL-PA-20 14-0021 


/ 


Figure  17:  Spherical  Earth  Target  -  Range  Boundary  Overshoot  Geometry 


Figure  18:  Spherical  Earth  Target  -  Range  Boundary  Undershoot  Geometry 

Figure  18  shows  the  undershoot  geometry  for  the  same  Aircraft,  constructed  using  the  near 
boundary  point,  BN.  In  this  case  we  wish  to  ensure  that  the  undershoot  buffer  angle  (i.e.,  the 
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angle  between  the  aircraft-target  and  aircraft-BN  vectors)  is  greater  than  or  equal  to  than  amax  • 
Once  again,  as  the  aircraft  approaches  the  target,  decreases,  and  the  buffer  angle  increases. 
When  the  undershoot  buffer  angle  is  equal  to  amax  ,  then  the  aircraft  ground  range  equals  the 
undershoot  range,  i.e.,  =  Ru. 


A  set  of  equations  allowing  mathematical  computation  of  the  overshoot  range  [18]  can  be 
derived  based  on  the  Geocentric  overshoot  geometry  and  parameters  shown  in  Fig.  19.  In  this 
Geocentric  geometry,  the  point  at  the  bottom  represents  the  center  of  the  Earth,  Re  represents  the 
radius  of  the  Earth,  and  the  curve  once  again  represents  the  surface  of  the  Earth.  We  should  note 
that  Fig.  19  represents  the  special  case  of  the  overshoot  geometry  where  the  overshoot  buffer 
angle  is  ^  =  amax  and  the  aircraft  ground  range  is  Rq  =  Ro.  Elevated  terrain  on  the  Range,  and  on 

the  CRA  boundary,  is  allowed  for  in  the  Figure.  If  we  assume  that  the  target  is  at  sea  level  (h  = 
0),  then  h  =  hois  the  elevation  of  the  overshoot  boundary  point  BF.  For  the  elevated  boundary 
point,  Rbo  represents  the  curved  earth  ground  range  from  the  target  position  to  a  zero  elevation 
point  directly  beneath  BF.  Finally,  if  we  assume  that  the  radius  of  the  Earth  is  large  with  respect 
to  any  ground  range  shown,  then  the  two  angles  subtending  the  curved  earth  arc  are  small  and 
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can  be  approximated  by  the  corresponding  ground  range  divided  by  Re,  i.e.,  0  =  RqIRe  and  (3  = 
ReJRe  ■ 

All  the  geometrie  parameters  of  Fig.  19  are  known  eonstants  exeept  for  the  (still  undetermined) 
overshoot  range  Rg  and  the  related  angle  0  =  RqIRe-  Using  the  geometry  of  Fig.  19,  we  can 
derive  a  funetion  relating  6  (and  thus  Rg)  to  all  the  other  parameters: 

/over  (^)  =  <^1  cos(^  +  y9)  +  fl2  COS ^  - eos (^4  - eos (^  +  /?))  -a^  (3.1) 


where 


aj 


+  h 

2,JrJr^^cos(P^^ 

Re 

2,jRjR^+h)cos(p^^ 


R^^+{R^+Hf 

2R^{R^+H) 

^  {R^+hf+{R^+Hf 

2{R^+h){R^+H) 

R^  (R^+h) cos J3  +  {R^+Hf 

'^^JRe  {Re  ^max 

Rb 

J3  =  -^ 

Re 


For  0  =  Ro/Re,  we  have  (^)  =  0 ,  and  Eq.  3.1  beeomes  one  equation  in  one  unknown,  whieh 

is  (in  theory)  soluble  for  either  0  or  Rg.  In  praetiee  the  equation  is  a  very  complex  funetion  of^, 
which  does  not  have  an  analytical  solution.  Instead,  it  must  be  solved  by  iteration,  evaluating  the 
funetion  for  a  series  of  estimated  Rg  values,  and  slowly  closing  in  on  the  range  for  whieh  Eq.  3.1 
gives  zero. 

A  similar  equation  for  eomputation  of  the  undershoot  range  ean  be  derived  based  on  the  special 
case  of  the  Geoeentrie  undershoot  geometry  where  the  undershoot  buffer  angle  is  equal  to  otmax  , 
the  aircraft  ground  range  equals  the  undershoot  range,  Rq  =  Ru  ,  and  0  =  RJRe-  The  funetion 
relating  0  (and  thus  i?„)  to  all  the  other  parameters  is  now: 

/under  (^)  =  ^1  COS +  COS 0  +  -cos^)(a4  -cos{0- P)^  - (3.2) 

Here  the  coefficients  ai  through  as  have  the  same  algebraie  form  as  for  Eq.  3.1  above,  but  in  this 
ease  h  =  hu  is  the  elevation  of  the  undershoot  boundary  point  BN,  P  =  i?Bu  /^e  ,  and  i?Bu 
represents  the  curved  earth  ground  range  from  the  target  position  to  a  zero  elevation  point 
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directly  beneath  BN.  Just  as  for  the  overshoot  calculation,  /binder  (^)  =  0  for  6  =  RJRe  ,  and  Eq. 
3.2  reduces  to  one  equation  in  one  unknown,  which  can  be  solved  for  by  iteration. 

We  now  return  to  the  topic  of  elevated  terrain  surrounding  the  target,  and  the  creation  of  a 
Terrain  Profile  Surface,  one  of  the  MATILDA  set-up  procedures  discussed  in  Section  3.3.  The 
Terrain  Profile  Surface  provides  the  means  of  ensuring  against  the  possibility  of  an  undershoot 
beam  accidentally  irradiating  elevated  terrain  areas  outside  the  CRA,  as  shown  in  Fig.  20. 


Figure  20:  Terrain  Undershoot  Problem 


The  initial  value  computed  for  the  undershoot  range  must  be  cross-checked  against  the  terrain 
elevations  given  by  the  Terrain  Profile  Surface,  in  order  to  make  sure  that  the  initial  undershoot 
range  avoids  this  kind  of  off-Range  irradiation  problem.  The  procedure  is  to  start  with  the  near 
CRA  boundary  point  and  bring  a  line  down  from  the  zenith  until  it  is  tangent  to  the  (stepped) 
Terrain  Profile  Surface.  This  point  of  contact  is  called  the  most  prominent  terrain  step  (MPTS). 
The  tangent  between  BN  and  the  MPTS  is  extended  upwards  to  the  aircraft  height,  H,  creating  a 
new  aircraft-target  slant  range.  The  new  ground  range  corresponding  to  this  new  slant  range  is 
now  a  second  undershoot  range  that  prevents  irradiation  of  off-Range  elevated  terrain.  The 
second  value  is  compared  to  the  initial  result  and  the  smaller  of  the  two  is  the  final  undershoot 
range  used  to  determine  the  FFLFZ. 

Once  we  have  calculated  the  undershoot  and  overshoot  ranges,  R„(cu)  and  Ro{<jo),  corresponding 
to  aircraft  height,  H,  and  to  some  radial  angle,  co,  between  the  target  and  the  near  CRA  boundary 
point,  the  overall  maximum  firing  range,  R{o)),  is  taken  to  be  the  smaller  of  the  two.  The  FFLFZ 
for  that  height  can  then  be  defined  by  calculating  the  set  cue  [0,27r)},  covering  all 

possible  radials  to  any  boundary  point.  The  FFLFZ  is  typically  plotted  by  laying  down  each 
range  at  the  proper  radial  angle  on  the  map,  plotting  the  end  point  of  each  range  vector,  and  then 
connecting  all  the  end  points  to  make  a  closed  contour  about  the  target.  This  process  is  repeated 
for  each  proposed  attack  height.  The  nested  series  of  contours  produced  defines  a  three- 
dimensional  envelope  for  the  acceptably-safe  firing  of  the  laser  during  fault-free  operation  of  the 
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laser  directional  control  system.  An  example  of  the  FFLFZ  contour  set,  generated  by  MATILDA 
for  our  Tain  Range  sample  case,  is  shown  in  Fig.  21. 


Figure  21:  MATILDA  Generated  Fault-Free  Laser  Firing  Zones 


Generation  of  the  FFLFZ  contours  completes  the  fault-free  laser  hazard  analysis  and  lays  the 
foundation  for  the  probabilistic  fault/failure  hazard  analysis  performed  in  CALCFAULT.  Prior 
to  execution  of  CALCFAULT;  however,  a  specific  laser  attack  scenario  must  be  defined. 
MATILDA  provides  a  feature,  the  Attack  Track  Waypoint  Editor  that  allows  an  analyst  to 
overlay  an  attack  track,  defined  by  a  series  of  waypoints,  onto  the  map.  The  data  entry  for 
waypoints  includes  waypoint  coordinates,  aircraft  altitude,  aircraft  velocity,  and  whether  the 
laser  is  firing  at  that  waypoint.  With  this  data,  MATILDA  compares  the  proposed  attack  track 
against  the  altitude  limitations  defined  by  the  FFLFZ  and  indicates  to  the  analyst  those  portions 
of  the  track  that  are  cleared  for  laser  firing  and  those  where  laser  firing  is  prohibited.  Fig.  22 
gives  an  example  of  such  a  user-entered  attack  track.  Note  that  the  vast  majority  of  the  attack 
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track  is  colored  green,  and  hence  cleared  for  firing,  but  a  small  portion  at  the  end  violates  FFLFZ 
altitude  limitations,  and  is  therefore  colored  red.  Only  the  portion  of  the  attack  track  that  clears 
FFLFZ  restrictions  is  analysed  during  CALCFAULT  execution. 


Figure  22:  Fault-Free  Attack  Track  Check 


3.6  CALCFAULT  Analysis 

The  third  module,  CALCFAULT,  performs  the  probabilistic  fault/failure  hazard  analysis  for  the 
designated  and  cleared  laser  attack  scenario,  to  determine  if  any  additional  restrictions  must  be 
imposed  on  the  laser  firing  envelope  permitted  by  the  FFLFZ.  The  CALCFAULT  analysis 
quantifies  the  actual  risk  for  firing  along  the  designated  attack  track,  in  the  event  of  a  fault  in,  or 
a  failure  of,  the  laser  directional  control  system.  The  probabilistic  Expectation  Model  discussed 
in  Section  2.5  is  used  in  this  analysis.  Key  input  parameters  for  the  CALCFAULT  analysis 
include  laser  system  parameters,  attack  track  data,  population  densities  of  the  Urban  Areas 
surrounding  the  Range,  the  terrain  computational  grid  (points  on  the  ground  for  which  ocular 
damage  probability  is  computed),  and  of  course,  the  maximum  acceptable  value  of  the  overall 
expectation  value,  E'movlmax- 


39 

Distribution  A:  Approved  for  public  release;  distribution  unlimited.  PA  Case  No:  TSRL-PA-20 14-0021 


Since  a  fault/failure  could  occur  at  any  point  during  the  course  of  the  cleared  laser  attack 
scenario,  a  large  number  of  failure  cases,  each  representing  a  possible  failure  at  a  different  point 
along  the  attack  track,  must  potentially  be  evaluated  and  their  overall  expectation  values 
compared  to  £'movlmax,  in  order  to  complete  the  fault  hazard  analysis.  Generally,  the  number  of 
failure  cases  evaluated  is  equal  to  the  number  of  pulses,  Np,  fired  during  the  attack  scenario;  i.e., 
the  fault  hazard  analysis  is  performed  for  a  possible  failure  at  each  of  the  laser  firing  positions. 
For  each  laser  pulse  emitted  after  the  fault/failure,  the  CALCFAULT  algorithm  evaluates  a 
corresponding  expectation  value,  cmovl,  that  a  MOVL  will  occur  in  the  unprotected  population 
surrounding  the  CRA.  The  number  of  pulses  emitted  after  a  fault  or  failure  has  occurred  depends 
on  the  pulse  repetition  frequency  (PRF)  and  the  length  of  time  required  for  the  laser  to  cease 
firing.  Consequently,  the  overall  expectation  value,  £'movl,  for  a  particular  failure  case,  is  the 
sum  of  the  individual  pulse  cmovl  values  for  the  period  of  time  during  which  the  laser  continues 
to  fire. 

The  overall  expectation  value,  EuowLii),  of  an  unprotected  observer  sustaining  a  MOVL  as  a 
result  of  a  Fault  or  Failure  occurring  on  the  z-th  pulse  emitted  during  laser  firing  operations  is 
given  by  [18]: 

m-\ 

■^MOVL  (0  “  "^S^MOVL  (*  “*“7)  (3-3) 

j=0 

where  is  the  probability  of  a  fault  occurring  on  the  z-th  pulse,  m  is  the  maximum  number  of 
pulses  emitted  during  a  fault,  and  eMovrCO  is  the  expectation  value  of  an  unprotected  observer 
sustaining  a  MOVL  as  a  result  of  the  z-th  pulse.  The  latter  is  given  by  the  expression: 

Wl(0  =  J I m<l>)g{0,<l>)  ded(t>  (3.4) 

9  cp 


In  Eq.  3.4, /(6>,^)  is  the  PDF  representing  the  (fault)  laser  pointing  error  and  will  depend  on  the 
laser  sightline  control  system.  The  random  variables  ^  g  O  and  0  g  0  represent  a  radial 
pointing  error  from  the  laser-target  vector  and  a  ‘compass’  direction  for  the  radial  error 
respectively.  The  quantity  g{0,^)  is  a  real-valued  function  representing  the  expected  number  of 
people  in  the  beam  footprint  sustaining  a  MOVL,  and  which  is  estimated  by 


g{A(0)=/3(«,^)s,(A«>)e'  ^MOVL  [h(r{94))) 


(3.5) 


Here  p [9,(1))  is  the  local  population  density  in  the  direction  {9,^),  is  the  area  of  the  beam 

footprint  on  the  ground  in  the  direction (6^, ^zi) ,  and  (^(^(^»^^)))  the  probability  of 

ocular  damage  from  laser  energy  density,  h ,  at  laser-observer  distance,  r ,  in  the  direction  {9,(f)) 

.  The  quantity  Q[x]  is  the  upper  tail  of  the  cumulative  normal  distribution. 
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(3.6) 


Q[x]  = 


1 


je  ^  dt 


and  represents  the  probability  that  a  person  who  has  an  oeular  exposure,  produeed  by  a  laser 
pulse  emitted  in  the  direetion  {0,  (p) ,  reeeives  a  MO VL.  The  lower  limit  x  =  ^MovL{h{r{e,(l)))) 
is  given  by 


where: 


^MOVL  (^(^(^’^))) 


-  log,  [h(r{0,  ^^)))  +  +  h  (^/) 

y 


2  2 

+  a  7] 


(3.7) 


h[r{^9,<l))^  =  the  laser  energy  density  at  the  cornea,  distance  r  in  the  direction  {0,<p)  in  mJm'^ 
a  =  1.715 


b{d)  =  8.5169  +  3.735381ogio  d 


jl4.035  {G„=\) 
[15.820  (G„>1) 


d  =  the  diameter  of  the  laser  image  on  the  retina 


f  30  pm  for  unaided  (naked-eye)  viewing  (G^  =  l) 

[90  pm  for  aided  viewing  with  magnifying  optics  (G^  >  l) 
T]  =  standard  deviation  of  log-irradiance 


=  1.1 


Each  direction  (^,  (zi)  will  also  have  an  associated  range,  r,  between  the  aircraft  and  the 
intersected  ground  point,  which  is  also  the  range  between  the  laser  and  a  possible  observer.  This, 
along  with  the  laser  beam  1/e-pt  beam  divergence,  (p^,  is  required  to  calculate  a  beam  area,  or 

beam  footprint,  ,  produced  when  the  beam  intersects  the  ground.  Then,  using  the  population 
density,  p{d,(p^,  associated  with  this  beam  area,  we  may  calculate  the  expected  number  of 
people,  N,  exposed  within  the  beam  footprint: 

N  =  pS^  (3.8) 

We  now  turn  to  a  discussion  of  the  computational  methods  used  to  numerically  evaluate  the 
Expectation  Model  described  above. 

The  integral  in  Eq.  3.4  gives  the  expectation  value  of  an  unprotected  observer  sustaining  a 
MOVE  as  a  result  of  a  single  pulse  emitted  after  a  fault/failure  event.  Since  it  is  generally  not 
feasible  to  obtain  an  analytic  form  forg(^,^),  this  integral  cannot  be  evaluated  analytically. 
Instead,  the  CALCFAULT  algorithm  numerically  evaluates  cmovl  {}),  using  a  set  of  terrain 
computational  points  representing  the  region  around  the  target  that  could  be  irradiated  while  the 
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laser  is  still  firing  following  a  directional  control  system  fault  or  failure.  The  elemental 
probability  that  any  given  terrain  computation  point  within  this  region  is  irradiated  can  be 
evaluated  using  the  fault  pointing  error  probability  density  function,  f{6,(j)).  The  expected 

number,  g(6*,(?i),  of  observers  sustaining  a  MOVL  at  each  of  the  computational  terrain  points  is 

estimated  as  the  product  of  the  ground-projected  beam  area  (the  beam  “footprinf ’)  with  the  local 
population  density  value  at  that  point. 

Eq.  3.4  can  thus  be  evaluated  numerically  as  the  weighted  sum  of  the  expectation  values  for  n 
terrain  points,  which  correspond  to  the  ground  intersection  points  of  a  set  of  laser  pointing  error 
directional  vectors  {9,  (p) ,  so  that 

(3-9) 

i=\ 

Here  the  expectation  value  sum  over  the  n  terrain  points  is  expressed  in  terms  of  the  directional 
vectors  (<9,  that  point  to  them.  For  a  flat-earth  geometry,  however,  it  is  most  convenient  to 
evaluate  the  expectation  value  sum  over  a  Cartesian  grid  of  equally  spaced  ground  points  (x,  y). 
For  each  Cartesian  ground  point,  (x, ,  y, ),  we  can  compute  the  angles,  6^  and  ,  representing  the 

corresponding  directional  vector:  9.  =  functionl[x.,y.)  and  (j).  =  function2{^x^,y^) .  The  sample 

weighting  function,  we{9^,(f>^,  is  then  related  to  the  determinant  of  the  Jacobian  matrix  used  to 

transform  the  PDF  of  the  laser  pointing  error  directional  vectors  from  angle  space  to  ground 
space. 

To  summarize,  numerical  evaluation  of  the  single  pulse  expectation  value  in  Eq.  3.9  consists  of 
the  following  sequence  of  steps.  First,  we  set  up  a  Cartesian  pointing  error  grid  in  the  ground 
plane  that  covers  the  range  of  directions  in  which  laser  energy  could  be  fired  before  laser  firing  is 
inhibited.  Next,  for  each  of  the  n  grid  points  we  calculate  the  angles  9^  and  (|)^ ,  and  determine 
the  size  of  the  (ground-projected)  laser  beam  footprint.  Finally,  we  calculate  the  appropriate 
values  of  and  / {9^,(/)^)  at  each  point  and  evaluate  the  weighted  sum. 

This  process  is  repeated  for  each  of  the  m  pulses  fired  following  a  fault/failure  event.  The  overall 
expectation  value  for  this  fault/failure  event,  given  by  Eq.  3.3,  is  then  the  sum  of  the  m  single 
pulse  expectation  values,  multiplied  by  the  probability  that  the  fault  failure  will  occur.  As 
mentioned,  CALCFAULT  will  calculate  Ap  overall  expectation  values  during  the  fault  hazard 
analysis,  one  for  a  possible  failure  at  each  of  the  Ap  laser  firing  positions  along  the  cleared  laser 
attack  track.  If  any  of  these  values  exceed  the  maximum  acceptable  value,  E'movlmax,  then  firing 
is  prohibited  over  that  portion  of  the  attack  track. 

To  conclude  Section  3.6,  we  now  give  CALCFAULT  results  for  our  Tain  Range  sample  case. 
For  the  sample  case,  MATILDA  first  uses  the  20  Hz  PRF,  and  the  FFLFZ-cleared  attack  track 
shown  in  Fig.  22,  to  determine  the  location  of  each  pulse  emitted  during  the  attack.  This  gives 
5200  possible  laser  firing  positions.  For  each  firing  position  CALCFAULT  determines  a  beam 
footprint  whose  boundaries  are  defined  by  the  maximum  (fault)  pointing  error  entered  (20 
degrees).  As  mentioned,  the  only  terrain  grid  points  that  need  be  evaluated  for  each  pulse,  and 
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corresponding  cmovl,  are  those  that  fall  within  the  range  of  directions  in  which  laser  energy  ean 
be  directed  before  laser  firing  is  inhibited. 

In  this  sample  case  each  £'movl  value,  evaluated  for  a  fault  at  one  of  the  5200  possible  laser 
firing  positions,  consists  of  the  sum  of  60  cmovl  values,  representing  the  60  pulses  fired  during 
the  3  second  laser  shutdown  period  following  the  fault.  Fig.  23  shows  a  comparison  of  all  5200 
Emovl  values  to  the  aceeptable  risk  threshold.  For  the  UK  Tain  Range  case  shown  here,  the 
standard  UK  value  of  £'movlmax  =  10'^  was  used.  As  we  see,  the  FFLFZ-cleared  attaek  traek  for 
the  Tain  Range  ease  does  not  exeeed  the  aceeptable  risk  threshold  for  a  laser  eontrol  error  at  any 
of  the  5200  firing  points.  It  would  therefore  be  approved  for  laser  firing  without  modification. 


CalcFaultResultsGraph 


Figure  23:  Comparison  of  EMOVL  Values  to  the  EMOVLMAX  Criterion 
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4  DISCUSSION 


The  concept  of  PRA  and  its  application  to  military  laser  safety  in  outdoor  environments  has  been 
gaining  in  ascendancy  in  recent  years,  as  the  advantage  of,  and  the  necessity  for,  a  probabilistic 
approach  to  laser  hazard  analysis  has  become  increasingly  accepted.  The  advantage  of  a  PRA- 
based  solution  over  the  standard  risk  analysis  method  involving  evaluation  of  the  NOHD  is 
amply  illustrated  in  Fig.  24,  in  which  a  Deterministic  Ocular  Hazard  Zone  (DOHZ),  based  on  the 
single  pulse  NOHD,  is  compared  with  a  probabilistically  derived  Laser  Hazard  Area  Trace 
(THAT)  that  has  been  defined  for  all  laser  pulses  emitted  during  the  attack  sequence.  In  this 
case,  the  PRA-based  THAT  is  much  smaller  in  extent  than  the  DOHZ.  Additionally,  the 
variation  of  risk  with  location  inside  the  THAT  can  be  evaluated,  whereas  the  interior  of  the 
DOHZ  can  only  be  described  as  ‘unsafe’.  As  an  example  of  how  this  might  benefit  the  DOD, 
AFRL  personnel  have  done  probability  of  injury  analysis,  as  a  function  of  location  of  ground 
observers,  for  reflections  from  airborne  ordnance  targeted  by  Army  ground-based  laser  systems. 


lyyVbertDiv 


10km  Radius  / 
Circle 

Centred  on  Target 


Ivisp  I  Siitollito  TGrrsin 


Deterministic 
Nominal 
Ocular  Hazard 
Zone  for  a 
single-laser 
pulse 


Probabilistic 
Laser  Hazard 
Area  for  LRMTS 
based  on  risk 
evaluation  for 
entire  attack 


Figure  24:  Comparison  of  a  PRA-Based  Laser  Hazard  Area  Trace  with  a  Deterministic  Ocular 

Hazard  Zone 
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PRA-based  methods  are  thus  perceived  to  offer  greater  flexibility  to  the  laser  system  operator, 
while  maintaining  acceptable  levels  of  safety  for  unprotected  members  of  the  general  public.  On 
the  other  hand,  the  PRA-based  method  does  not  come  without  additional  cost.  Due  to  the 
smaller  margins  of  safety  involved  in  the  PRA  method,  based  on  what  is  deemed  to  satisfy  the 
ALARP  principle,  a  substantial  amount  of  preliminary  effort  is  required  to  establish  the 
performance  attributes  of  the  laser  system  and  ensure  the  validity  of  the  subsequent  hazard 
analysis.  The  Laser  System  Safety  Investigation  (LSSI),  needed  to  adequately  characterise  the 
fault- free  performance  and  fault/failure  characteristics  of  the  laser  directional  control  system,  has 
been  described  in  detail  in  a  previous  publication  [14]. 

Perhaps  the  most  important  requirement  of  the  PRA-based  clearance  method  is  the  determination 
of  what  level  of  risk  is  deemed  to  be  acceptable  to  unprotected  members  of  the  general  public  in 
the  vicinity  of  laser  system  test  or  training  operations.  The  acceptable  level  of  risk  will  vary 
from  one  jurisdiction  to  another,  and  should  be  decided  at  an  appropriate  policy  level  within  the 
host  country’s  chain  of  executive  responsibility.  As  mentioned  previously,  the  maximum 
acceptable  risk  level  set  by  the  UK  MOD  is  10'*  occurrences  of  MOVL  per  attack.  There  is 
currently  no  acceptable  risk  level  specified  for  US  Ranges,  because  PRA  is  still  too  new  in  DOD 
applications.  The  identified  acceptable  level  of  risk  will  have  an  impact  on  the  flexibility  of  the 
resulting  clearance  restrictions.  In  general,  the  more  stringent  are  the  safety  criteria,  the  less 
flexible  will  be  the  resulting  clearance  restrictions. 


5  CONCLUSIONS 

The  use  of  Probabilistic  Risk  Assessment  (PRA)  techniques  to  perform  laser  safety  and  hazard 
analysis  for  high  output  lasers  in  outdoor  environments  has  become  an  increasingly  accepted 
alternative  to  standard  risk  analysis  methods,  based  on  Maximum  Permissible  Exposure  (MPE) 
limits.  Over  the  past  ten  years,  the  United  Kingdom  (UK)  Ministry  of  Defence  (MoD)  and  the 
United  States  (US)  Air  Force  Research  Eaboratory  (AFRL)  have  collaborated  to  develop  a 
jointly-owned,  PRA-based,  laser  Range  safety  tool,  the  Military  Advanced  Technology 
Integrated  Easer  hazarD  Assessment  (MATILDA)  system. 

PRA-based  laser  hazard  analysis  offers  a  number  of  advantages  over  standard  risk  analysis 
methods.  First,  it  provides  a  quantified  assessment  of  human  risk  (probability  of  injury)  as  a 
function  of  location.  Second,  it  captures  the  probabilities  and  consequences  of  human  error  and 
laser  fault/failure  conditions,  factors  which  are  critical  to  valid  hazard  assessments  for  military 
laser  operations  in  uncontrolled  outdoor  environments.  Third,  and  most  importantly,  PRA 
analysis  does  not  assume,  or  require,  a  zero  risk  condition  as  a  final  result.  Instead,  it  compares 
the  quantified  risk  against  a  maximum  acceptable  (non-zero)  risk  value.  This  produces  less 
restrictive  Range  clearances,  while  still  maintaining  safety  levels  deemed  acceptable  for  Range 
personnel  and  members  of  the  public.  This  last  advantage  is  critical  for  the  UK,  where  the  small 
size  of  UK  Ranges  and  the  possibility  that  laser  beams  might  escape  Range  boundaries  make  a 
zero  risk  condition  for  Range  testing  unacceptably  restrictive. 

Over  the  past  four  decades,  the  UK  MoD  has  pioneered  the  development  of  PRA-based  models 
for  laser  hazard  assessment,  using  them  to  assess  laser  irradiation  risks  to  unprotected  persons 
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from  outdoor  test  and  training  operations  on  UK  military  Ranges.  The  United  States  Air  Force 
(USAF)  has  also  identified  the  need  for  a  PRA-based  approach  in  the  quantification  of  laser 
hazards.  Discussions  between  the  USAF  and  the  UK  MoD  revealed  a  common  objective  in 
developing  a  jointly  owned,  PRA-based,  laser  Range  safety  tool.  Thus,  UK  laser  PRA  modelling 
expertise  and  AFRL  expertise  in  development  of  advanced  laser  hazard  assessment  tools  were 
combined  to  create  the  MATILDA  tool. 

The  MATILDA  system  is  a  new  software  tool  based  on  open-source  Geographic  Information 
System  (GIS)  technology,  which  integrates  relevant  laser  system  performance  parameters  with 
environmental  data  appropriate  to  the  Range  location  where  the  system  is  being  operated.  It 
provides  a  modem,  low-cost,  portable  computational  environment,  which  may  be  tailored 
equally  to  the  needs  of  the  local  Range  safety  technician  and  the  expert  analyst.  MATILDA 
provides  the  user/analyst  with  the  means  to  efficiently  assess  risks  arising  from  different  attack 
profiles  on  any  given  target,  and  ensures  that  the  results  are  consistent  with  acceptable  safety 
criteria.  The  result  is  an  optimum  level  of  flexibility  in  laser  Range  operations,  while  still 
maintaining  high  standards  of  safety  for  unprotected  persons  near  the  Range.  MATILDA  is  the 
first  military  software  tool  to  contain  a  complete  end-to-end  laser  PRA  model,  crafted  for  Range 
applications,  and  with  generalized  terrain  modelling.  In  the  future  it  will  provide  a  starting  point 
for  development  of  more  advanced  laser  PRA  models  and  tools. 
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